Detectionmediumstable

Windows Defender Threat Detection Service Disabled

Detects when the "Windows Defender Threat Protection" service is disabled.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Ján Trenčanský, François HubautCreated Tue Jul 28Updated Tue Jul 026c0a7755-6d31-44fa-80e1-133e57752680windows

Log Source

Windowssystem

ProductWindows← raw: windows

Servicesystem← raw: system

Detection Logic

detection:
    selection:
        EventID: 7036
        Provider_Name: 'Service Control Manager'
        # Note: The service name and messages are localized
        param1:
            - 'Windows Defender Antivirus Service'
            - 'Service antivirus Microsoft Defender' # French OS
        param2:
            - 'stopped'
            - 'arrêté' # French OS
    condition: selection