Windows windefend EventID 5001: Windows Defender real-time protection disabled
Flags windefend Event ID 5001 indicating Windows Defender real-time protection was disabled.
- Product
- windows
- Service
- windefend
- Author
- Ján Trenčanský, frack113 (SigmaHQ), DRL 1.1
- Published
- 2020-07-28
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows Defender real-time protection being disabled, based on windefend events with EventID 5001. Disabling real-time protection reduces endpoint defenses and is commonly used to impair detection or prolong attacker activity. It relies on Windows Defender/Windows Firewall Defender notification telemetry from the windefend service, specifically the presence of EventID 5001.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5001
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
- craigclouditpro.wordpress.comhttps://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_real_time_protection_disabled.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows windefend EventID 5001: Windows Defender real-time protection disabled"
id: 22d15917-1124-481b-8586-e27e51bc87b9
related:
- id: fe34868f-6e0e-4882-81f6-c43aa8f15b62
type: obsolete
- id: b28e58e4-2a72-4fae-bdee-0fbe904db642
type: derived
status: stable
description: This rule flags Windows Defender real-time protection being disabled, based on windefend events with EventID 5001. Disabling real-time protection reduces endpoint defenses and is commonly used to impair detection or prolong attacker activity. It relies on Windows Defender/Windows Firewall Defender notification telemetry from the windefend service, specifically the presence of EventID 5001.
references:
- https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5001
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
- https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_real_time_protection_disabled.yml
author: Ján Trenčanský, frack113, Huntrule Team
date: 2020-07-28
modified: 2023-11-22
tags:
- attack.defense-impairment
- attack.t1685
logsource:
product: windows
service: windefend
detection:
selection:
EventID: 5001
condition: selection
falsepositives:
- Administrator actions (should be investigated)
- Seen being triggered occasionally during Windows 8 Defender Updates
level: high
license: DRL-1.1