Defender Event ID 5007 — Microsoft Defender configuration changed

A Microsoft Defender Antivirus setting was changed — for example an added scan exclusion (path, process, or extension), a disabled feature, or a changed cloud-protection level. Records the value name plus old and new values.

Why event 5007 matters

Attackers add exclusions so Defender ignores their payload directory or process (Set-MpPreference -ExclusionPath / -ExclusionProcess). Exclusion additions for user-writable paths, script interpreters, or wide roots (C:\) are strong indicators of evasion.

How to detect it

Alert on new exclusions, especially for user-writable or overly broad paths and for interpreters (powershell, cmd, wscript). Correlate with 4688 command lines and 4657 registry writes to Exclusions keys.

MITRE ATT&CK mapping

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

title: Defender Exclusion Or Config Change
status: experimental
logsource:
  product: windows
  service: windefend
detection:
  sel:
    EventID: 5007
  keywords:
    - 'Exclusions'
  condition: sel and keywords
level: medium

Event
| where EventLog == "Microsoft-Windows-Windows Defender/Operational" and EventID == 5007   // Microsoft Defender configuration changed
// EventData holds: Value, New Value, Old Value
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:Microsoft-Windows-Windows Defender/Operational" EventCode=5007
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# Microsoft Defender configuration changed — add EventData fields: Value, New Value, Old Value`

References

• learn.microsoft.com

Related Configuration Change events