Windows registry artifactWindows Defender Status
Displays the status of whether Windows Defender AntiSpyware is enabled or not. 0 = Enabled (AntiSpyware On), 1 = Disabled
- Threat Hunting
- 4 keys
SOFTWARE
Registry keys
4 keys that RECmd reads for this artifact
SOFTWAREDisableAntiSpywarePolicies\Microsoft\Windows DefenderDisplays the status of whether Windows Defender AntiSpyware is enabled or not. 0 = Enabled (AntiSpyware On), 1 = Disabled
SOFTWAREDisableAntiSpywareMicrosoft\Windows DefenderDisplays the status of whether Windows Defender AntiSpyware is enabled or not. 0 = Enabled (AntiSpyware On), 1 = Disabled
SOFTWAREDisableAntiVirusPolicies\Microsoft\Windows DefenderDisplays the status of whether Windows Defender AntiVirus is enabled or not. 0 = Enabled (AntiVirus On), 1 = Disabled
SOFTWAREDisableAntiVirusMicrosoft\Windows DefenderDisplays the status of whether Windows Defender AntiVirus is enabled or not. 0 = Enabled (AntiVirus On), 1 = Disabled
References
3 links
- docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware(opens in new tab)
- answers.microsoft.com/en-us/protect/forum/all/how-to-kill-antimalware-service-executable/b5ce5b46-a65b-460c-b4cd-e2cca50358cf(opens in new tab)
- gist.github.com/MHaggis/a955f1351a7d07592b90ab605e3b02d9(opens in new tab)
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)