How do you detect attempts to disable Microsoft Defender?

Detect Defender tampering through commands, events and prevention telemetry. Alert on Set-MpPreference and Add-MpPreference with DisableRealtimeMonitoring, DisableBehaviorMonitoring or exclusion parameters, on sc stop WinDefend and DisableAntiSpyware registry writes, and on Defender Operational Events 5001 and 5007. Enable tamper protection so most attempts fail, and alert on the TamperingAttempt signals it generates. Treat broad exclusions for drive roots, user folders or executable extensions as high priority.

Detecting Microsoft Defender Tampering: Set-MpPreference, Exclusions and Services

Ransomware affiliates and commodity malware routinely try to disable Microsoft Defender with Set-MpPreference, registry edits, service stops or by adding blanket exclusions. Tamper protection blocks much of this when enabled, but the blocked attempts and the successful ones both generate telemetry. Coverage here is among the highest-value, lowest-noise detections you can run.

Signals at a Glance

Signal	Where	ATT&CK
Set-MpPreference with DisableRealtimeMonitoring, DisableBehaviorMonitoring or DisableIOAVProtection	PowerShell 4104, Sysmon 1	T1562.001
Add-MpPreference -ExclusionPath, -ExclusionProcess or -ExclusionExtension	PowerShell 4104, Defender 5007	T1562.001
Real-time protection disabled (Defender Event 5001)	Defender Operational	T1562.001
sc stop WinDefend, sc config, or DisableAntiSpyware set in the registry	Sysmon 1, 13	T1562.001
Tamper protection blocked an attempt	MDE TamperingAttempt alerts	T1562.001

Command-Line and Event Detections

Start with the commands, because they appear in nearly every intrusion that bothers to try. Defender also logs the result: Event 5001 when real-time protection is turned off and 5007 whenever its configuration changes, including added exclusions.

// Microsoft Defender XDR (KQL) - Defender tampering commands and blocked attempts
let cmds = DeviceProcessEvents
| where ProcessCommandLine has_any ("Set-MpPreference", "Add-MpPreference")
| where ProcessCommandLine has_any ("DisableRealtimeMonitoring", "DisableBehaviorMonitoring",
        "DisableIOAVProtection", "DisableScriptScanning", "ExclusionPath",
        "ExclusionProcess", "ExclusionExtension", "MAPSReporting 0", "SubmitSamplesConsent 2")
   or ProcessCommandLine has_all ("sc", "stop", "WinDefend")
   or ProcessCommandLine has_all ("reg", "DisableAntiSpyware")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName;
let blocked = DeviceEvents
| where ActionType == "TamperingAttempt"
| project Timestamp, DeviceName, AdditionalFields, InitiatingProcessFileName;
cmds
| union blocked
| order by Timestamp desc
// tune/validate: confirm TamperingAttempt is exposed in your tenant.

For hosts without Defender for Endpoint telemetry, the Defender Operational log still carries the evidence. Alert on the change events and review who or what made them:

index=wineventlog source="WinEventLog:Microsoft-Windows-Windows Defender/Operational"
  (EventCode=5001 OR EventCode=5007 OR EventCode=5010 OR EventCode=5012)
| eval change=case(EventCode=5001,"realtime_disabled",
                   EventCode=5007,"config_changed",
                   EventCode=5010,"scan_disabled",
                   EventCode=5012,"antivirus_scan_disabled")
| rex field=Message "New value:\s*(?<new_value>.+)"
| where change!="config_changed" OR like(new_value,"%Exclusions%")
| stats count min(_time) as first by host, change, new_value
`comment("tune/validate: allow expected exclusions pushed by your management platform")`

Hardening and Triage

Turn on tamper protection and manage it centrally; most local attempts then fail and become a single alert instead of a silent disablement.
Alert on exclusion additions for drive roots, user profile folders, Temp, or whole extensions such as .exe and .dll.
Check exclusions in the registry (Exclusions\Paths, Exclusions\Extensions) during triage; adversaries often add them before dropping tools.
Correlate with BYOVD indicators: operators who cannot disable Defender via policy may switch to a vulnerable driver.

Vetted sources

Use the SigmaHQ Defender tampering and exclusion rules, Elastic’s defense-evasion detections for Defender, Splunk ESCU content on Set-MpPreference, Microsoft’s tamper protection documentation and Atomic Red Team T1562.001 tests. Baseline your own environment — deployment tooling and security software legitimately add exclusions.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Command-Line and Event Detections

Hardening and Triage

Build Detections That Fire

Defense Evasion Detection

Detection Hub

BYOVD Detection

AMSI Bypass Detection