detection.wiki

Microsoft-Windows-Windows Defender › Event 5101

Event ID 5101 — {Product Name} grace period has expired.

Provider
Microsoft-Windows-Windows Defender
Channel
Operational

Message #

{Product Name} grace period has expired. Protection against viruses; spyware; and other potentially unwanted software is disabled. 	Expiration Reason: {Expiration Reason} 	Expiration Date (UTC): {Expiration Date (UTC)} 	Error Code: {Error Code} 	Error Description: {Error Description}

Detection Rules #

View all rules referencing this event →

Sigma # view in reference

  • Windows Defender Grace Period Expired source high: Detects the expiration of the grace period of Windows Defender. This means protection against viruses, spyware, and other potentially unwanted software is disabled.

References #