LoFP LoFP / administrator activity (must be investigated)

Techniques

Sample rules

Windows Defender Submit Sample Feature Disabled

Description

Detects disabling of the “Automatic Sample Submission” feature of Windows Defender.

Detection logic

condition: selection
selection:
  EventID: 5007
  NewValue|contains: \Real-Time Protection\SubmitSamplesConsent = 0x0

Windows Defender Configuration Changes

Description

Detects suspicious changes to the Windows Defender configuration

Detection logic

condition: selection
selection:
  EventID: 5007
  NewValue|contains:
  - '\Windows Defender\DisableAntiSpyware '
  - '\Windows Defender\Scan\DisableRemovableDriveScanning '
  - '\Windows Defender\Scan\DisableScanningMappedNetworkDrivesForFullScan '
  - '\Windows Defender\SpyNet\DisableBlockAtFirstSeen '
  - '\Real-Time Protection\SpyNetReporting '