Detection rules › Sigma
Disable Tamper Protection on Windows Defender
Detects disabling Windows Defender Tamper Protection
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 13: RegistryEvent (Value Set) |
Rule body
title: Disable Tamper Protection on Windows Defender
id: 93d298a1-d28f-47f1-a468-d971e7796679
status: test
description: Detects disabling Windows Defender Tamper Protection
references:
- https://www.tenforums.com/tutorials/123792-turn-off-tamper-protection-microsoft-defender-antivirus.html
author: Austin Songer @austinsonger
date: 2021-08-04
modified: 2023-08-17
tags:
- attack.defense-impairment
- attack.t1685
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: '\Microsoft\Windows Defender\Features\TamperProtection'
Details: DWORD (0x00000000)
filter_msmpeng_client: # only disabled temporarily during updates
Image|startswith: 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
Image|endswith: '\MsMpEng.exe'
filter_msmpeng_domain_controller: # only disabled temporarily during updates
Image: 'C:\Program Files\Windows Defender\MsMpEng.exe'
condition: selection and not 1 of filter_*
falsepositives:
- Unknown
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_*Stage 1: selection
selection:
TargetObject|contains: '\Microsoft\Windows Defender\Features\TamperProtection'
Details: DWORD (0x00000000)
Stage 2: not filter_*
filter_msmpeng_client:
Image|startswith: 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
Image|endswith: '\MsMpEng.exe'
filter_msmpeng_domain_controller:
Image: 'C:\Program Files\Windows Defender\MsMpEng.exe'
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Image | ends_with | \MsMpEng.exe | excludes:Image field:"Image" value:"\MsMpEng.exe" |
Image | starts_with | C:\ProgramData\Microsoft\Windows Defender\Platform\ | excludes:Image field:"Image" value:"C:\ProgramData\Microsoft\Windows Defender\Platform\" |
Image | eq | C:\Program Files\Windows Defender\MsMpEng.exe | excludes:Image field:"Image" value:"C:\Program Files\Windows Defender\MsMpEng.exe" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Details | eq |
| field:"Details" kind:eq value:"DWORD (0x00000000)" |
TargetObject | match |
| field:"TargetObject" kind:match value:"\Microsoft\Windows Defender\Features\TamperProtection" |