Disable Tamper Protection on Windows Defender

Title: Disable Tamper Protection on Windows Defender
Status: test
Description:Detects disabling Windows Defender Tamper Protection
References:
  -https://www.tenforums.com/tutorials/123792-turn-off-tamper-protection-microsoft-defender-antivirus.html
Author: Austin Songer @austinsonger
Date: 2021-08-04
modified:2023-08-17
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains: '\Microsoft\Windows Defender\Features\TamperProtection'
    Details: 'DWORD (0x00000000)'
  filter_msmpeng_client:
    Image|startswith: 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
    Image|endswith: '\MsMpEng.exe'
  filter_msmpeng_domain_controller:
    Image: 'C:\Program Files\Windows Defender\MsMpEng.exe'
  condition:selection and not 1 of filter_*
Falsepositives:
  -Unknown
Level: medium