Microsoft Defender Tamper Protection Triggered Blocked Setting Change
This rule detects blocked attempts to modify Microsoft Defender Antivirus settings when Tamper Protection is enabled. Specifically, it looks for Event ID 5013 from the Windows Defender service, which indicates that Tamper Protection has blocked a change to Defender's configuration. The rule targets attempts to disable key features such as AntiSpyware, AntiVirus, archive scanning, network file scanning, real-time monitoring, behavior monitoring, IOAV protection, and script scanning by monitoring specific registry value paths.
Sigma
