Investigation: Windows Defender Disabled or Tamper Protection Turned Off

1. Confirm the alert

   Detects the outright disabling of Microsoft Defender rather than a mere exclusion: Set-MpPreference toggles that switch off real-time, behaviour, script or IOAV protection, MpCmdRun definition wipes, tamper-protection registry edits, and sc/net stop of the WinDefend, WdNisSvc or Sense services. On an SMB estate Defender is the primary control, so a kill of the engine is almost always the last defence-evasion step before a payload is dropped or ransomware detonates. The rule matched on logsource `process_creation`. Verify the event genuinely matches the described behavior, and not a known legitimate case. The rule matches on these fields — examine the exact value in the event:

   • **CommandLine** contains: `DisableRealtimeMonitoring`, `DisableBehaviorMonitoring`, `DisableIOAVProtection`, `DisableScriptScanning` …

2. Pivot: find the origin and context

   Investigation queries (read-only):

   • Parent of the triggering process (full execution chain)
   • Other processes spawned by the same parent within 10 minutes
   • Is the binary signed? unusual path (%TEMP%, %APPDATA%, user directory)?

3. Rule out false positives

   Known benign causes for this rule:

   • Admin re-enabling protection ($false / 0) is already scoped out by the filter; an operator temporarily disabling real-time protection during a noisy software install is the main residual FP - correlate with the parent process and the follow-up re-enable event.

4. Context (threat intelligence)

   The rule's references — CTI context to qualify the incident:

   • https://attack.mitre.org/techniques/T1562/001/