Windows Defender Submit Sample Feature Disabled
Detects disabling of the "Automatic Sample Submission" feature of Windows Defender.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
detection:
selection:
EventID: 5007 # The antimalware platform configuration changed.
NewValue|contains: '\Real-Time Protection\SubmitSamplesConsent = 0x0'
condition: selectionAdministrator activity (must be investigated)
Tactics
Sub-techniques
Windows Defender Exclusions Added
Detects the Setting of Windows Defender Exclusions
Detects similar activity. Both rules may fire on overlapping events.
Windows Defender Exploit Guard Tamper
Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedApplications"
Detects similar activity. Both rules may fire on overlapping events.
Windows Defender Configuration Changes
Detects suspicious changes to the Windows Defender configuration
Detects similar activity. Both rules may fire on overlapping events.