Event ID 5010 — ProductName scanning for spyware and other potentially unwanted software is disabled.

Provider: Microsoft-Windows-Windows Defender
Channel: Operational
Collection Priority: Recommended (Microsoft-Defender)

Description

ProductName scanning for spyware and other potentially unwanted software is disabled.

Message #

%1 scanning for spyware and other potentially unwanted software is disabled.

Fields #

Name	Description
`ProductName` UnicodeString	—
`ProductVersion` UnicodeString	—

Detection Rules #

View all rules referencing this event →

Sigma # view in reference

Windows Defender Malware And PUA Scanning Disabled source high: Detects disabling of the Windows Defender feature of scanning for malware and other potentially unwanted software

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/