Windows Defender Real-Time Protection Failure or Restart

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•27

This rule detects events indicating issues with Windows Defender Real-Time Protection features. Specifically, it triggers when Real-Time Protection encounters an error and fails (EventID 3002) or when a Real-Time Protection feature restarts (EventID 3007). It filters out common false positives related to Network Inspection System errors due to missing updates or unknown antimalware security intelligence issues.