Detecting Defender Antivirus Tamper Protection Disablement and Registry Evasion

Before deploying ransomware or running noisy post-exploitation tools, threat actors frequently attempt to neutralize host defenses. A primary method involves modifying Windows Defender registry values to disable real-time scanning, script scanning, or behavior monitoring.

Here is how to detect anti-malware tampering across endpoints with Defender XDR.

Log Source

• Microsoft Defender for Endpoint: DeviceRegistryEvents

Defender Tampering KQL Alert Query

// Detect Registry Modifications Disabling Windows Defender Security Controls
let timeWindow = 7d;
let monitoredValues = dynamic([
    "DisableRealtimeMonitoring",
    "DisableBehaviorMonitoring",
    "DisableOnAccessProtection",
    "DisableScanOnRealtimeEnable",
    "DisableIOAVProtection",
    "DisableIntrusionPreventionSystem",
    "DisableScriptScanning"
]);
DeviceRegistryEvents
| where TimeGenerated >= ago(timeWindow)
| where RegistryKey has @"Microsoft\Windows Defender"
| where RegistryValueName in~ (monitoredValues)
// Value "1" or "0x00000001" disables protection
| where RegistryValueData in ("1", "0x00000001", "dword:00000001")
| project TimeGenerated, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

High-Risk Initiating Processes

• reg.exe or powershell.exe: Common scripts invoke reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f.
• If the initiating process is an unrecognized binary executing from AppData or Temp, treat as active ransomware staging.

Defense in Depth

• Ensure Tamper Protection is enforced tenant-wide via Microsoft Intune or Defender portal settings. When Tamper Protection is active, local registry modifications are automatically ignored and reverted.

MITRE ATT&CK Mapping

• Tactic: Defense Evasion (TA0005)
• Technique: Impair Defenses: Disable or Modify Tools (T1562.001)