Sigma rules · CVE-2019-10044

Home/CVE-2019-10044/Sigma rules

Sigma

Sigma rules for CVE-2019-10044

51 rules · scoped to cve · back to CVE-2019-10044

Direct rules mention this entity in their title or description. Related rules cover the techniques this entity is known to use.

◈

Detection rules

1 of 51

direct high

Windows Defender Grace Period Expired

Detects the expiration of the grace period of Windows Defender. This means protection against viruses, spyware, and other potentially unwanted software is disabled.

status stable author Ján Trenčanský, frack113 id 360a1340-398a-46b6-8d06-99b905dc69d2 license Sigma · DRL-1.1

view Sigma YAML

title: Windows Defender Grace Period Expired
id: 360a1340-398a-46b6-8d06-99b905dc69d2
related:
    - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62
      type: obsolete
status: stable
description: |
    Detects the expiration of the grace period of Windows Defender. This means protection against viruses, spyware, and other potentially unwanted software is disabled.
references:
    - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5101
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
    - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/
author: Ján Trenčanský, frack113
date: 2020-07-28
modified: 2023-11-22
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: windows
    service: windefend
detection:
    selection:
        EventID: 5101 # The antimalware platform is expired.
    condition: selection
falsepositives:
    - Unknown
level: high

Showing 51-51 of 51

Prev 2 Next