Defender Event ID 5001: Real-time protection is disabled
Written when Defender's real-time protection is turned off.
- Log
- Microsoft-Windows-Windows Defender/Operational
- Category
- Defense evasion
Why it matters
- Turning off antivirus is a common step just before running ransomware or other tools that would be detected.
What to check
Check what happened just before (4688 or 4104 with Set-MpPreference) and whether it was turned back on.
How to turn it on
Logged by default when Defender Antivirus is active.
MITRE ATT&CK
- T1562.001 Disable or Modify Tools