Windows Defender Real-Time Protection Failure/Restart

Title: Windows Defender Real-Time Protection Failure/Restart
Status: stable
Description:Detects issues with Windows Defender Real-Time Protection features
References:
  -Internal Research
  -https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
  -https://gist.github.com/nasbench/33732d6705cbdc712fae356f07666346
Author: Nasreddine Bencherchali (Nextron Systems), Christopher Peacock '@securepeacock' (Update)
Date: 2023-03-28
modified:2023-05-05
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: windows
• service: windefend

Detection:
  selection:
    EventID:
      -'3002'
      -'3007'

  filter_optional_network_inspection:
    Feature_Name: '%%886'
    Reason:
      -'%%892'
      -'%%858'

  condition:selection and not 1 of filter_optional_*
Falsepositives:
  -Some crashes can occur sometimes and the event doesn't provide enough information to tune out these cases. Manual exception is required
Level: medium