Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Windows Impair Defense Disable Win Defender Scan On Update

The following analytic detects modifications to the Windows registry that disable the Windows Defender Scan On Update feature. It leverages data from the Endpoint.Registry datamodel, specifically looking for changes to the "DisableScanOnUpdate" registry setting with a value of "0x00000001". This activity is significant because disabling automatic scans can leave systems vulnerable to malware and other threats. If confirmed malicious, this action could allow attackers to bypass Windows Defender, facilitating further compromise and persistence within the environment.

ATT&CK coverage

Outside the enterprise matrix

T1685

Detection requirements

Log source category: sysmon_eventid_13

What the source says

What fires this without an attack behind it

It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.

References

Tagged by the source as

Windows Defense Evasion TacticsWindows Registry AbuseEndpointendpointSplunk CloudSplunk EnterpriseSplunk Enterprise Securityendpoint

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.