detection.wiki

Detection rules › Sigma

Disabled Windows Defender Eventlog

Status
test
Severity
high
Log source
category registry_set, product windows
Author
Florian Roth (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections

Known false positives

  • Other Antivirus software installations could cause Windows to disable that eventlog (unknown)

MITRE ATT&CK coverage

TacticTechniques
Defense Impairment

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 13: RegistryEvent (Value Set)

Rule body

title: Disabled Windows Defender Eventlog
id: fcddca7c-b9c0-4ddf-98da-e1e2d18b0157
status: test
description: Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections
references:
    - https://twitter.com/WhichbufferArda/status/1543900539280293889/photo/2
author: Florian Roth (Nextron Systems)
date: 2022-07-04
modified: 2023-08-17
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\Enabled'
        Details: 'DWORD (0x00000000)'
    condition: selection
falsepositives:
    - Other Antivirus software installations could cause Windows to disable that eventlog (unknown)
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    TargetObject|contains: '\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\Enabled'
    Details: 'DWORD (0x00000000)'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Detailseq
  • DWORD (0x00000000) corpus 38 (sigma 36, chronicle 2)
field:"Details" kind:eq value:"DWORD (0x00000000)"
TargetObjectmatch
  • \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\Enabled
field:"TargetObject" kind:match value:"\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\Enabled"