Detecting Security Tooling Disablement Before Ransomware

Before deploying, ransomware operators blind the defenders: turning off real-time protection, adding broad exclusions, stopping EDR services or loading a vulnerable driver to terminate protected processes. Each action is configuration change or process behaviour you can log, and each is almost never legitimate on a production server.

Signals at a Glance

Defender Configuration Changes

Defender logs preference changes and protection state to its Operational channel. Alert on the disable and exclusion events, and on registry writes that mimic the same change from a script:

title: Defender Protection Disabled or Excluded
logsource:
  category: process_creation
  product: windows
detection:
  sel_disable:
    CommandLine|contains:
      - 'DisableRealtimeMonitoring'
      - 'DisableBehaviorMonitoring'
      - 'DisableIOAVProtection'
      - 'DisableScriptScanning'
  sel_exclusion:
    CommandLine|contains|all:
      - 'Add-MpPreference'
      - 'Exclusion'
  sel_registry:
    CommandLine|contains|all:
      - 'DisableAntiSpyware'
      - 'reg'
  condition: 1 of sel_*
level: high
# tune/validate: allowlist the management account that applies approved exclusions

EDR Termination and Driver Abuse

Protected EDR processes are usually killed through a vulnerable signed driver. The driver load is the visible step. Alert on driver loads that are new to your estate or on the vendor block lists, then on security processes exiting immediately afterward:

// Defender / Sentinel (KQL) - new driver followed by security service stop
let drivers = DeviceEvents
| where ActionType == "DriverLoad"
| where isempty(SHA256) == false
| summarize firstSeen=min(Timestamp), hosts=dcount(DeviceId) by SHA256, FileName
| where hosts <= 2 and firstSeen > ago(1d);
drivers
| join kind=inner (DeviceEvents | where ActionType == "ServiceStopped" or ActionType == "ProcessTerminated") on $left.FileName == $right.FileName
// tune/validate: schema and ActionType values depend on your EDR; adapt the join key

• Enable tamper protection and manage it centrally so local disablement fails and logs.
• Page on any security-tool disable on a server or domain controller; there is rarely a benign reason.
• Apply the vendor and community vulnerable-driver block lists through application control.