Defender Event ID 5001 — Microsoft Defender real-time protection disabled

Real-time protection configuration for Microsoft Defender Antivirus was changed or disabled.

Why event 5001 matters

A classic pre-attack blinding step. Adversaries run Set-MpPreference -DisableRealtimeMonitoring $true, tamper with registry keys under Policies\Microsoft\Windows Defender, or stop the service. Any real-time protection disable outside a controlled maintenance window is high signal.

How to detect it

Alert on every real-time protection disable. Correlate with 4688 (Set-MpPreference / powershell), 4657 registry changes under Windows Defender keys, and 7036/7040 service state changes for WinDefend. Allow-list approved maintenance jobs only.

MITRE ATT&CK mapping

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

title: Defender Real-Time Protection Disabled
status: experimental
logsource:
  product: windows
  service: windefend
detection:
  sel:
    EventID: 5001
  condition: sel
level: high

Event
| where EventLog == "Microsoft-Windows-Windows Defender/Operational" and EventID == 5001   // Microsoft Defender real-time protection disabled
// EventData holds: Feature, New Value, Old Value
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:Microsoft-Windows-Windows Defender/Operational" EventCode=5001
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Microsoft Defender real-time protection disabled — add EventData fields: Feature, New Value, Old Value`

References

• learn.microsoft.com

Related Configuration Change events