Event ID 5012 — ProductName scanning for viruses is disabled.

Provider: Microsoft-Windows-Windows Defender
Channel: Operational
Collection Priority: Recommended (Microsoft-Defender)

Description

ProductName scanning for viruses is disabled.

Message #

%1 scanning for viruses is disabled.

Fields #

Name	Description
`ProductName` UnicodeString	—
`ProductVersion` UnicodeString	—

Detection Rules #

View all rules referencing this event →

Sigma # view in reference

Windows Defender Virus Scanning Feature Disabled source high: Detects disabling of the Windows Defender virus scanning feature

References #

RULER Project https://ruler-project.github.io/ruler-project/RULER/av/Microsoft%20Defender/