Detection rules › Sigma
Microsoft Defender real time protection failure (native)
Detects scenarios where an attacker tamper Defender RTP protection and disable it.
Known false positives
- Defender configuration issue or patch breaking the configuration
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Windows-Defender | Event ID 3002: ProductName Real-Time Protection feature has encountered an error and failed. |
Rule body
title: Microsoft Defender real time protection failure (native)
description: Detects scenarios where an attacker tamper Defender RTP protection and disable it.
references:
- https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
- https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide
tags:
- attack.defense_evasion
- attack.t1562.001
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: windefend
detection:
selection:
EventID: 3002
condition: selection
falsepositives:
- Defender configuration issue or patch breaking the configuration
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 3002