Defender Event ID 5007: The antimalware platform configuration changed
Written when a Defender setting changes, with the old and new value.
- Log
- Microsoft-Windows-Windows Defender/Operational
- Category
- Defense evasion
Why it matters
- New exclusions (paths, extensions or processes) are a common way to hide malware from Defender.
What to check
Check the Old Value and New Value, especially any change under Exclusions.
How to turn it on
Logged by default when Defender Antivirus is active.
MITRE ATT&CK
- T1562.001 Disable or Modify Tools