Detection rules › Sigma

Windows Defender Threat Detection Service Disabled

Severity
medium
Author
Ján Trenčanský, frack113
Source
upstream

Detects when the "Windows Defender Threat Protection" service is disabled.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1562.001 Impair Defenses: Disable or Modify Tools

Event coverage

ProviderEvent IDTitle
Service-Control-Manager7036

Stages and Predicates

Stage 1: selection

param1: ['Service antivirus Microsoft Defender', 'Windows Defender Antivirus Service']
param2: ['arrêté', stopped]
Provider_Name: 'Service Control Manager'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Provider_Nameeq
  • Service Control Manager corpus 43 (sigma 43)
param1eq
  • Service antivirus Microsoft Defender
  • Windows Defender Antivirus Service
param2eq
  • arrêté
  • stopped