Disabled Windows Defender Eventlog

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•23

This rule detects when the Windows Defender operational event log is disabled by setting its 'Enabled' registry value to 0. This activity has been observed in relation to Lockbit 3.0 ransomware infections as a defense evasion technique.