CVE-2026-33825 Google Chronicle · YARA-L

Detect CVE-2026-33825 - Microsoft Defender Insufficient Access Control Exploitation in Google Chronicle

Detects exploitation attempts targeting CVE-2026-33825, an insufficient granularity of access control vulnerability (CWE-1220) in Microsoft Defender. This KEV-listed vulnerability allows attackers to bypass Defender access controls, potentially disabling protections, modifying exclusions, or tampering with security configurations without appropriate privilege levels.

MITRE ATT&CK

Tactic
Defense Evasion Privilege Escalation Persistence

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2026_33825_defender_access_control_bypass {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects exploitation of CVE-2026-33825: Microsoft Defender Insufficient Access Control. Monitors Defender tamper events, registry modifications, and process-level bypass attempts."
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825"
    mitre_attack = "T1562.001, T1548"
    cve = "CVE-2026-33825"
    rule_version = "1.0"

  events:
    (
      // Windows Defender Operational - Protection disabled or config changed
      $e1.metadata.event_type = "PROCESS_UNCATEGORIZED"
      and $e1.metadata.product_name = "Microsoft-Windows-Windows Defender"
      and $e1.metadata.product_event_type in ("5001", "5004", "5007", "5010", "5012", "5013")
    )
    or
    (
      // Registry modification to Defender keys by non-system account
      $e1.metadata.event_type = "REGISTRY_MODIFICATION"
      and re.regex($e1.target.registry.registry_key, `(?i)(HKLM\\SOFTWARE\\(Policies\\)?Microsoft\\Windows Defender)`)
      and not $e1.principal.user.userid in ("S-1-5-18", "S-1-5-19", "S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464")
    )
    or
    (
      // PowerShell Defender bypass commands
      $e1.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($e1.principal.process.file.full_path, `(?i)powershell\.exe$`)
      and re.regex($e1.target.process.command_line, `(?i)(Set-MpPreference|Add-MpPreference|Remove-MpPreference).*(DisableRealtimeMonitoring|ExclusionPath|ExclusionProcess|DisableBehaviorMonitoring|DisableIOAVProtection)`)
      and not $e1.principal.user.userid = "S-1-5-18"
    )
    or
    (
      // sc.exe stopping/disabling Defender services
      $e1.metadata.event_type = "PROCESS_LAUNCH"
      and re.regex($e1.target.process.file.full_path, `(?i)sc\.exe$`)
      and re.regex($e1.target.process.command_line, `(?i)(WinDefend|MsMpEng|SecurityHealthService).*(stop|disable|delete|config)`)
      and not $e1.principal.user.userid = "S-1-5-18"
    )

  condition:
    $e1
}
critical severity high confidence

Chronicle YARA-L 2.0 rule detecting CVE-2026-33825 Defender access control bypass via Defender operational event monitoring, registry modification detection on Defender configuration keys, and process-level command monitoring for PowerShell and sc.exe tampering.

Data Sources

Google Chronicle SIEMWindows Event Logs ingested via Chronicle forwarderSysmon via Chronicle

Required Tables

UDM Events (PROCESS_LAUNCH, REGISTRY_MODIFICATION, PROCESS_UNCATEGORIZED)

False Positives & Tuning

  • SYSTEM account (S-1-5-18) performing legitimate Defender configuration updates during Windows Update
  • Authorized Group Policy processing modifying Defender registry keys from legitimate policy application
  • IT helpdesk personnel adding temporary Defender exclusions for software installation via approved change tickets
  • Enterprise security tools (CrowdStrike, Carbon Black) adjusting Defender settings for product co-existence

Other platforms for CVE-2026-33825

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Disable Defender Real-Time Monitoring via PowerShell (CVE-2026-33825 Simulation)

    Expected signal: Sysmon EventID 1 (process creation) for powershell.exe with CommandLine containing Set-MpPreference and DisableRealtimeMonitoring; Windows Defender Operational EventID 5001 (real-time protection disabled); DeviceProcessEvents in MDE showing the PowerShell invocation

  2. Test 2Add Defender Exclusion Path via PowerShell

    Expected signal: Sysmon EventID 1 for powershell.exe with Add-MpPreference and ExclusionPath in CommandLine; Defender Operational EventID 5007 (configuration changed) with new exclusion path; registry modification to HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths

  3. Test 3Stop WinDefend Service via sc.exe

    Expected signal: Sysmon EventID 1 (process creation) for sc.exe with CommandLine 'sc stop WinDefend'; Windows System EventID 7036 (WinDefend service stopped); Security EventID 4689 (process exit) for MsMpEng.exe if service fully stops; Defender Operational EventID 5001

  4. Test 4Modify Defender Registry Key to Disable Antispyware

    Expected signal: Sysmon EventID 13 (registry value set) with TargetObject HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware and Details=DWORD (0x00000001); Security EventID 4657 for registry write to Defender policy key; Defender Operational EventID 5007

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the initiating account (SID and username) responsible for the Defender configuration change or service modification. Determine whether the account has legitimate administrative duties and whether a change ticket exists for this activity.
  2. Review the specific Defender setting modified: determine if real-time protection was disabled, exclusions were added (and for what paths/processes), or if the Defender service was stopped. Assess the blast radius — was the endpoint left unprotected and for how long?
  3. Correlate the tamper event timestamp with any concurrent malware execution, lateral movement, or data staging activity on the same host using process creation and network connection logs to assess whether exploitation enabled follow-on attack stages.
  4. Check whether the same account or technique was applied to multiple endpoints within the environment, suggesting automated exploitation or scripted attacker tooling leveraging CVE-2026-33825 at scale.

Containment

  1. Immediately isolate the affected endpoint from the network using EDR network containment to prevent lateral movement, especially if concurrent malicious process execution is observed or if Defender protections were found disabled for more than a brief window.
  2. Force a Defender re-enable and policy refresh via Microsoft Intune, SCCM, or Group Policy to restore real-time protection, remove unauthorized exclusions, and restart any stopped Defender services. Verify restoration via endpoint health dashboard before releasing from isolation.

Evidence Collection

  1. Capture a full memory image and disk snapshot of the affected endpoint prior to remediation to preserve forensic evidence of any payloads that may have executed while Defender was disabled. Collect Windows Defender operational event log (Microsoft-Windows-Windows Defender/Operational) and Security event log (Event IDs 4657, 4670, 5001-5013) as primary evidence.
  2. Export process creation logs (Sysmon EventID 1 or Security EventID 4688) covering the 30-minute window around the Defender tamper event to identify the parent process chain, the initiating binary, and any child processes spawned while protections were degraded.

Escalation Criteria

  • !Escalate immediately to incident response if Defender was found disabled and concurrent malicious process execution, credential harvesting tools (Mimikatz, ProcDump targeting LSASS), or lateral movement artifacts (PsExec, WMI remote execution) are observed in the same timeframe.
  • !Escalate if the tamper activity is attributed to a service account, domain admin, or privileged identity that should not be executing ad-hoc PowerShell or sc.exe commands, indicating possible credential compromise and privilege abuse beyond the initial Defender bypass.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Windows Defender Operational Log (Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational): EventIDs 5001 (Real-time protection disabled), 5004 (Real-time protection configuration changed), 5007 (Antimalware configuration changed), 5010 (Scanning for malware disabled), 5012 (Scanning for viruses disabled), 5013 (Antivirus protection disabled)
  • >Security Event Log EventID 4657 (Registry value modified) and 4670 (Registry permissions changed) with ObjectName targeting HKLM\SOFTWARE\Microsoft\Windows Defender or HKLM\SOFTWARE\Policies\Microsoft\Windows Defender
  • >Prefetch files for powershell.exe, sc.exe, reg.exe, and MpCmdRun.exe on the affected host indicating execution of Defender-modifying commands
  • >PowerShell ScriptBlock logs (EventID 4104) capturing full Set-MpPreference or Add-MpPreference command content including specific exclusion paths or protection settings modified

Tuning Guidance

Baseline legitimate Defender management accounts (typically SYSTEM, TrustedInstaller, and specific service accounts tied to MDM platforms) and suppress alerts originating exclusively from those identities. For PowerShell detections, consider filtering on known-good parent processes (gpscript.exe for GPO-driven policy, IntuneManagementExtension.exe for MDM). Add exception handling for documented change windows where IT teams perform bulk Defender configuration updates. If SCCM or Intune is in use, correlate Defender change events with deployment job IDs to filter policy-driven changes. Tune the registry detection to ignore value changes where the new value re-enables protection (e.g., DisableRealtimeMonitoring set to 0), focusing on changes that weaken or disable controls.

Hunting Queries

Retrospective 7-day hunt for targeted Defender registry key modifications that disable specific protection capabilities. These keys are the primary mechanism attackers use after gaining access control bypass to persist Defender in a weakened state. Covers real-time monitoring, behavior monitoring, IOAV, on-access protection, and antispyware/antivirus master disablement flags.

Hunting — KQL
kql 
DeviceRegistryEvents
| where TimeGenerated > ago(7d)
| where RegistryKey has "Windows Defender"
| where ActionType in ("RegistryValueSet", "RegistryValueDeleted")
| where RegistryValueName in ("DisableRealtimeMonitoring", "DisableBehaviorMonitoring", "DisableIOAVProtection", "DisableOnAccessProtection", "DisableScanOnRealtimeEnable", "DisableAntiSpyware", "DisableAntiVirus")
| where InitiatingProcessAccountName !in ("SYSTEM", "TrustedInstaller", "LOCAL SERVICE")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated desc
Hunting — SPL
spl 
index=sysmon EventCode=13 TargetObject="*\\Windows Defender\\*"
| where TargetObject IN ("*DisableRealtimeMonitoring*", "*DisableBehaviorMonitoring*", "*DisableIOAVProtection*", "*DisableAntiSpyware*", "*DisableAntiVirus*")
| where NOT (User="NT AUTHORITY\\SYSTEM" OR User="NT AUTHORITY\\LOCAL SERVICE")
| eval details=TargetObject." = ".Details
| table _time, ComputerName, User, Image, details
| sort -_time

Hunt for MpCmdRun.exe (Defender command-line tool) invoked with suspicious flags such as definition removal or remediation disablement, which attackers can use post-access-control-bypass to degrade signature coverage or disable remediation actions on detected threats.

Hunting — KQL
kql 
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "MpCmdRun.exe"
| where ProcessCommandLine has_any ("-RemoveDefinitions", "-SignatureUpdate", "-DisableRemediation")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated desc
Hunting — SPL
spl 
index=sysmon EventCode=1 Image="*\\MpCmdRun.exe"
| where CommandLine IN ("*-RemoveDefinitions*", "*-SignatureUpdate*", "*-DisableRemediation*")
| table _time, ComputerName, User, CommandLine, ParentCommandLine
| sort -_time

Atomic Red Team Tests

Test 1 Disable Defender Real-Time Monitoring via PowerShell (CVE-2026-33825 Simulation)
windows

Simulates the most common Defender bypass technique enabled by CVE-2026-33825 — using PowerShell Set-MpPreference to disable real-time monitoring without appropriate privilege validation. In a lab environment, this demonstrates the telemetry generated and validates detection coverage.

Command

powershell 
powershell.exe -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Write-Host 'RTP disabled'"

Cleanup

powershell 
powershell.exe -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $false; Write-Host 'RTP re-enabled'"

Expected Telemetry

Sysmon EventID 1 (process creation) for powershell.exe with CommandLine containing Set-MpPreference and DisableRealtimeMonitoring; Windows Defender Operational EventID 5001 (real-time protection disabled); DeviceProcessEvents in MDE showing the PowerShell invocation

Expected Detection

Alert should fire on kql/spl/crowdstrike_cql queries matching Set-MpPreference with DisableRealtimeMonitoring flag from a non-SYSTEM account

Test 2 Add Defender Exclusion Path via PowerShell
windows

Adds a broad filesystem exclusion to Defender to simulate an attacker staging malware in an excluded directory after bypassing Defender access controls. This is a common follow-on technique after initial Defender bypass.

Command

powershell 
powershell.exe -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Temp\malware_staging'; Write-Host 'Exclusion added'"

Cleanup

powershell 
powershell.exe -ExecutionPolicy Bypass -Command "Remove-MpPreference -ExclusionPath 'C:\Temp\malware_staging'; Write-Host 'Exclusion removed'"

Expected Telemetry

Sysmon EventID 1 for powershell.exe with Add-MpPreference and ExclusionPath in CommandLine; Defender Operational EventID 5007 (configuration changed) with new exclusion path; registry modification to HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths

Expected Detection

Alert should fire on queries matching Add-MpPreference with ExclusionPath argument; registry hunting query should surface the new exclusion key

Test 3 Stop WinDefend Service via sc.exe
windows

Attempts to stop the Windows Defender service (WinDefend) using sc.exe to simulate service-level Defender disablement that an attacker might achieve after exploiting CVE-2026-33825's access control weakness.

Command

powershell 
cmd.exe /c sc stop WinDefend && sc query WinDefend

Cleanup

powershell 
cmd.exe /c sc start WinDefend

Expected Telemetry

Sysmon EventID 1 (process creation) for sc.exe with CommandLine 'sc stop WinDefend'; Windows System EventID 7036 (WinDefend service stopped); Security EventID 4689 (process exit) for MsMpEng.exe if service fully stops; Defender Operational EventID 5001

Expected Detection

Alert should trigger on sc.exe CommandLine matching WinDefend with stop keyword from non-SYSTEM account; service stop event correlation in kql/spl queries

Test 4 Modify Defender Registry Key to Disable Antispyware
windows

Directly modifies the DisableAntiSpyware registry value under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender to simulate a registry-level access control bypass, as would be possible if CVE-2026-33825 allows writing to policy-controlled Defender registry paths.

Command

powershell 
reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f

Cleanup

powershell 
reg.exe delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /f

Expected Telemetry

Sysmon EventID 13 (registry value set) with TargetObject HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware and Details=DWORD (0x00000001); Security EventID 4657 for registry write to Defender policy key; Defender Operational EventID 5007

Expected Detection

Registry hunting query should surface DisableAntiSpyware=1 modification; kql and spl registry modification detections should alert on this specific key/value combination

Related Detections

Tactic Hubs

TA0005Defense EvasionTA0004Privilege EscalationTA0003Persistence

Related Techniques

T1562.001Disable or Modify ToolsT1548Abuse Elevation Control MechanismT1543.003Windows ServiceT1112Modify Registry

Same Tactic: Defense Evasion

Popular Detections