Windows Defender Submit Sample Feature Disabled

Title: Windows Defender Submit Sample Feature Disabled
Status: stable
Description:Detects disabling of the "Automatic Sample Submission" feature of Windows Defender.
References:
  -https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide
  -https://bidouillesecurity.com/disable-windows-defender-in-powershell/#DisableAntiSpyware
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-06
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: windows
• service: windefend

Detection:
  selection:
    EventID: '5007'
    NewValue|contains: '\Real-Time Protection\SubmitSamplesConsent = 0x0'
  condition:selection
Falsepositives:
  -Administrator activity (must be investigated)
Level: low