Lion Cipher Lab
Detect Microsoft Defender tampering from its own Operational log (5001, 5007, 5013)
- SOC Analyst / Blue Team
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Before an intruder runs their real tool on a Windows machine, they very often try to blind the antivirus first: turn off real-time protection, or quietly tell Microsoft Defender to stop scanning a folder, then drop their payload into that folder. MITRE ATT&CK tracks this as T1685, Disable or Modify Tools (numbered T1562.001 under Impair Defenses until ATT&CK v19 revoked that family and renumbered it). The good news is that Defender writes these changes into its own event log. The bad news is that the same log is full of harmless configuration churn, so the obvious rule — alert on every…
What you'll learn
- Reading the Microsoft-Windows-Windows Defender/Operational channel and knowing which event IDs mean tampering (5001, 5007, 5010, 5012, 5013) versus detection (1116, 1117)
- Parsing a 5007 configuration-change New value into an exclusion type (Paths, Extensions, Processes) and value
- Writing a change-window-aware impair-defenses detection for MITRE ATT&CK T1685 (formerly T1562.001)
- Correlating a Defender exclusion with a prior detection and with a file drop into the newly excluded folder
- Measuring precision and recall of three rules against labeled data, and reading every false positive and false negative by hand
- Naming the limits of log-based tampering detection and the control (Tamper Protection) that prevents what the rule only reports
Steps in this lab
- What tampering with an antivirus looks like, and why attackers bother
- Meet the Defender Operational log and the event IDs that matter
- Why 'alert on every 5007' fails (the judgement)
- Build the synthetic week of events
- Write three rules and score them
- Read the progression like an analyst, not a scoreboard
- The miss, and what fixing it costs
- The honest limits of reading the AV's own log
- Prevention first: Tamper Protection, and how to check it
- Optional: read your own Defender log (read-only)
- Where this goes next