Disable Defender Submit Samples Consent Feature

name: Disable Defender Submit Samples Consent Feature
id: 73922ff8-3022-11ec-bf5e-acde48001122
version: 16
creation_date: '2021-10-18'
modification_date: '2026-06-08'
author: Teoderick Contreras, Splunk, Steven Dick
status: production
type: TTP
description: The following analytic detects the modification of the Windows registry to disable the Windows Defender Submit Samples Consent feature. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path associated with Windows Defender SpyNet and the SubmitSamplesConsent value set to 0x00000000. This activity is significant as it indicates an attempt to bypass or evade detection by preventing Windows Defender from submitting samples for further analysis. If confirmed malicious, this could allow an attacker to execute malicious code without being detected by Windows Defender, leading to potential system compromise.
data_source:
    - Sysmon EventID 13
search: |
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry
      WHERE (
              Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" AND
              Registry.registry_value_name = SubmitSamplesConsent AND
              Registry.registry_value_data IN (0, 0x00000000)
             )
              by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product
         | `drop_dm_object_name(Registry)`
         | where isnotnull(registry_value_data)
         | `security_content_ctime(firstTime)`
         | `security_content_ctime(lastTime)`
         | `disable_defender_submit_samples_consent_feature_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709
known_false_positives: admin or user may choose to disable windows defender product
references:
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
finding:
    title: modified/added/deleted registry entry $registry_path$ on $dest$
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: modified/added/deleted registry entry $registry_path$ on $dest$
analytic_story:
    - Azorult
    - CISA AA23-347A
    - IcedID
    - Windows Registry Abuse
    - BlankGrabber Stealer
    - Salat Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1685
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint