Detect CVE-2026-33825 - Microsoft Defender Insufficient Access Control Exploitation in Splunk
Detects exploitation attempts targeting CVE-2026-33825, an insufficient granularity of access control vulnerability (CWE-1220) in Microsoft Defender. This KEV-listed vulnerability allows attackers to bypass Defender access controls, potentially disabling protections, modifying exclusions, or tampering with security configurations without appropriate privilege levels.
MITRE ATT&CK
SPL Detection Query
index=wineventlog OR index=sysmon OR index=defender
| eval source_category=case(
sourcetype="WinEventLog:Security", "security_events",
sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational", "sysmon",
sourcetype="WinEventLog:Microsoft-Windows-Windows Defender/Operational", "defender_ops",
true(), "other"
)
| where (EventCode IN (5001, 5004, 5007, 5010, 5012, 5013, 3002) AND sourcetype="WinEventLog:Microsoft-Windows-Windows Defender/Operational")
OR (EventCode IN (4657, 4670) AND (Object_Name LIKE "%Windows Defender%" OR Object_Name LIKE "%MsMpEng%"))
OR (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" AND EventCode=13 AND TargetObject LIKE "%Windows Defender%" AND (NOT (User="NT AUTHORITY\\SYSTEM" OR User="NT AUTHORITY\\LOCAL SERVICE")))
OR (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" AND EventCode IN (1, 11) AND (
(Image LIKE "%powershell.exe" AND (CommandLine LIKE "%Set-MpPreference%" OR CommandLine LIKE "%DisableRealtimeMonitoring%" OR CommandLine LIKE "%ExclusionPath%"))
OR (Image LIKE "%sc.exe" AND (CommandLine LIKE "%WinDefend%" OR CommandLine LIKE "%MsMpEng%") AND (CommandLine LIKE "%stop%" OR CommandLine LIKE "%disable%"))
OR (Image LIKE "%reg.exe" AND CommandLine LIKE "%Windows Defender%" AND (CommandLine LIKE "% add %" OR CommandLine LIKE "% delete %"))
))
| eval suspicious_indicator=case(
EventCode IN (5001, 5004, 5010, 5012, 5013), "Defender_Protection_Disabled",
EventCode=5007, "Defender_Config_Modified",
EventCode IN (4657, 4670), "Registry_ACL_Changed",
CommandLine LIKE "%DisableRealtimeMonitoring%" OR CommandLine LIKE "%ExclusionPath%", "RealTime_Exclusion_Added",
CommandLine LIKE "%stop%" OR CommandLine LIKE "%disable%", "Defender_Service_Stopped",
true(), "Unknown_Tamper_Activity"
)
| eval host_name=coalesce(ComputerName, host, "unknown"), account=coalesce(User, SubjectUserName, "unknown")
| stats count AS event_count, values(suspicious_indicator) AS indicators, min(_time) AS first_seen, max(_time) AS last_seen, values(CommandLine) AS commands BY host_name, account
| where event_count >= 1
| eval alert="CVE-2026-33825 Suspected Defender Access Control Bypass"
| table last_seen, first_seen, alert, host_name, account, event_count, indicators, commands
| sort -last_seenSplunk query detecting Defender operational log events indicating protection status changes (5001, 5004, 5010-5013), configuration modifications (5007), registry ACL changes, and process-level Defender tampering consistent with CVE-2026-33825 exploitation.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Group Policy or MDM-enforced Defender configuration changes applied by SYSTEM or TrustedInstaller accounts
- Security product migrations where Defender is intentionally disabled before installing an enterprise AV solution
- Authorized red team or penetration testing exercises with documented scope
- Automated patching workflows that temporarily modify Defender exclusions during software deployment
Other platforms for CVE-2026-33825
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Disable Defender Real-Time Monitoring via PowerShell (CVE-2026-33825 Simulation)
Expected signal: Sysmon EventID 1 (process creation) for powershell.exe with CommandLine containing Set-MpPreference and DisableRealtimeMonitoring; Windows Defender Operational EventID 5001 (real-time protection disabled); DeviceProcessEvents in MDE showing the PowerShell invocation
- Test 2Add Defender Exclusion Path via PowerShell
Expected signal: Sysmon EventID 1 for powershell.exe with Add-MpPreference and ExclusionPath in CommandLine; Defender Operational EventID 5007 (configuration changed) with new exclusion path; registry modification to HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
- Test 3Stop WinDefend Service via sc.exe
Expected signal: Sysmon EventID 1 (process creation) for sc.exe with CommandLine 'sc stop WinDefend'; Windows System EventID 7036 (WinDefend service stopped); Security EventID 4689 (process exit) for MsMpEng.exe if service fully stops; Defender Operational EventID 5001
- Test 4Modify Defender Registry Key to Disable Antispyware
Expected signal: Sysmon EventID 13 (registry value set) with TargetObject HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware and Details=DWORD (0x00000001); Security EventID 4657 for registry write to Defender policy key; Defender Operational EventID 5007
Response Playbook
Triage
- Identify the initiating account (SID and username) responsible for the Defender configuration change or service modification. Determine whether the account has legitimate administrative duties and whether a change ticket exists for this activity.
- Review the specific Defender setting modified: determine if real-time protection was disabled, exclusions were added (and for what paths/processes), or if the Defender service was stopped. Assess the blast radius — was the endpoint left unprotected and for how long?
- Correlate the tamper event timestamp with any concurrent malware execution, lateral movement, or data staging activity on the same host using process creation and network connection logs to assess whether exploitation enabled follow-on attack stages.
- Check whether the same account or technique was applied to multiple endpoints within the environment, suggesting automated exploitation or scripted attacker tooling leveraging CVE-2026-33825 at scale.
Containment
- Immediately isolate the affected endpoint from the network using EDR network containment to prevent lateral movement, especially if concurrent malicious process execution is observed or if Defender protections were found disabled for more than a brief window.
- Force a Defender re-enable and policy refresh via Microsoft Intune, SCCM, or Group Policy to restore real-time protection, remove unauthorized exclusions, and restart any stopped Defender services. Verify restoration via endpoint health dashboard before releasing from isolation.
Evidence Collection
- Capture a full memory image and disk snapshot of the affected endpoint prior to remediation to preserve forensic evidence of any payloads that may have executed while Defender was disabled. Collect Windows Defender operational event log (Microsoft-Windows-Windows Defender/Operational) and Security event log (Event IDs 4657, 4670, 5001-5013) as primary evidence.
- Export process creation logs (Sysmon EventID 1 or Security EventID 4688) covering the 30-minute window around the Defender tamper event to identify the parent process chain, the initiating binary, and any child processes spawned while protections were degraded.
Escalation Criteria
- !Escalate immediately to incident response if Defender was found disabled and concurrent malicious process execution, credential harvesting tools (Mimikatz, ProcDump targeting LSASS), or lateral movement artifacts (PsExec, WMI remote execution) are observed in the same timeframe.
- !Escalate if the tamper activity is attributed to a service account, domain admin, or privileged identity that should not be executing ad-hoc PowerShell or sc.exe commands, indicating possible credential compromise and privilege abuse beyond the initial Defender bypass.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Windows Defender Operational Log (Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational): EventIDs 5001 (Real-time protection disabled), 5004 (Real-time protection configuration changed), 5007 (Antimalware configuration changed), 5010 (Scanning for malware disabled), 5012 (Scanning for viruses disabled), 5013 (Antivirus protection disabled) - >
Security Event Log EventID 4657 (Registry value modified) and 4670 (Registry permissions changed) with ObjectName targeting HKLM\SOFTWARE\Microsoft\Windows Defender or HKLM\SOFTWARE\Policies\Microsoft\Windows Defender - >
Prefetch files for powershell.exe, sc.exe, reg.exe, and MpCmdRun.exe on the affected host indicating execution of Defender-modifying commands - >
PowerShell ScriptBlock logs (EventID 4104) capturing full Set-MpPreference or Add-MpPreference command content including specific exclusion paths or protection settings modified
Tuning Guidance
Baseline legitimate Defender management accounts (typically SYSTEM, TrustedInstaller, and specific service accounts tied to MDM platforms) and suppress alerts originating exclusively from those identities. For PowerShell detections, consider filtering on known-good parent processes (gpscript.exe for GPO-driven policy, IntuneManagementExtension.exe for MDM). Add exception handling for documented change windows where IT teams perform bulk Defender configuration updates. If SCCM or Intune is in use, correlate Defender change events with deployment job IDs to filter policy-driven changes. Tune the registry detection to ignore value changes where the new value re-enables protection (e.g., DisableRealtimeMonitoring set to 0), focusing on changes that weaken or disable controls.
Hunting Queries
Retrospective 7-day hunt for targeted Defender registry key modifications that disable specific protection capabilities. These keys are the primary mechanism attackers use after gaining access control bypass to persist Defender in a weakened state. Covers real-time monitoring, behavior monitoring, IOAV, on-access protection, and antispyware/antivirus master disablement flags.
DeviceRegistryEvents
| where TimeGenerated > ago(7d)
| where RegistryKey has "Windows Defender"
| where ActionType in ("RegistryValueSet", "RegistryValueDeleted")
| where RegistryValueName in ("DisableRealtimeMonitoring", "DisableBehaviorMonitoring", "DisableIOAVProtection", "DisableOnAccessProtection", "DisableScanOnRealtimeEnable", "DisableAntiSpyware", "DisableAntiVirus")
| where InitiatingProcessAccountName !in ("SYSTEM", "TrustedInstaller", "LOCAL SERVICE")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated descindex=sysmon EventCode=13 TargetObject="*\\Windows Defender\\*"
| where TargetObject IN ("*DisableRealtimeMonitoring*", "*DisableBehaviorMonitoring*", "*DisableIOAVProtection*", "*DisableAntiSpyware*", "*DisableAntiVirus*")
| where NOT (User="NT AUTHORITY\\SYSTEM" OR User="NT AUTHORITY\\LOCAL SERVICE")
| eval details=TargetObject." = ".Details
| table _time, ComputerName, User, Image, details
| sort -_timeHunt for MpCmdRun.exe (Defender command-line tool) invoked with suspicious flags such as definition removal or remediation disablement, which attackers can use post-access-control-bypass to degrade signature coverage or disable remediation actions on detected threats.
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "MpCmdRun.exe"
| where ProcessCommandLine has_any ("-RemoveDefinitions", "-SignatureUpdate", "-DisableRemediation")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated descindex=sysmon EventCode=1 Image="*\\MpCmdRun.exe"
| where CommandLine IN ("*-RemoveDefinitions*", "*-SignatureUpdate*", "*-DisableRemediation*")
| table _time, ComputerName, User, CommandLine, ParentCommandLine
| sort -_timeAtomic Red Team Tests
Simulates the most common Defender bypass technique enabled by CVE-2026-33825 — using PowerShell Set-MpPreference to disable real-time monitoring without appropriate privilege validation. In a lab environment, this demonstrates the telemetry generated and validates detection coverage.
Command
powershell.exe -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $true; Write-Host 'RTP disabled'"Cleanup
powershell.exe -ExecutionPolicy Bypass -Command "Set-MpPreference -DisableRealtimeMonitoring $false; Write-Host 'RTP re-enabled'"Expected Telemetry
Sysmon EventID 1 (process creation) for powershell.exe with CommandLine containing Set-MpPreference and DisableRealtimeMonitoring; Windows Defender Operational EventID 5001 (real-time protection disabled); DeviceProcessEvents in MDE showing the PowerShell invocation
Expected Detection
Alert should fire on kql/spl/crowdstrike_cql queries matching Set-MpPreference with DisableRealtimeMonitoring flag from a non-SYSTEM account
Adds a broad filesystem exclusion to Defender to simulate an attacker staging malware in an excluded directory after bypassing Defender access controls. This is a common follow-on technique after initial Defender bypass.
Command
powershell.exe -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Temp\malware_staging'; Write-Host 'Exclusion added'"Cleanup
powershell.exe -ExecutionPolicy Bypass -Command "Remove-MpPreference -ExclusionPath 'C:\Temp\malware_staging'; Write-Host 'Exclusion removed'"Expected Telemetry
Sysmon EventID 1 for powershell.exe with Add-MpPreference and ExclusionPath in CommandLine; Defender Operational EventID 5007 (configuration changed) with new exclusion path; registry modification to HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
Expected Detection
Alert should fire on queries matching Add-MpPreference with ExclusionPath argument; registry hunting query should surface the new exclusion key
Attempts to stop the Windows Defender service (WinDefend) using sc.exe to simulate service-level Defender disablement that an attacker might achieve after exploiting CVE-2026-33825's access control weakness.
Command
cmd.exe /c sc stop WinDefend && sc query WinDefendCleanup
cmd.exe /c sc start WinDefendExpected Telemetry
Sysmon EventID 1 (process creation) for sc.exe with CommandLine 'sc stop WinDefend'; Windows System EventID 7036 (WinDefend service stopped); Security EventID 4689 (process exit) for MsMpEng.exe if service fully stops; Defender Operational EventID 5001
Expected Detection
Alert should trigger on sc.exe CommandLine matching WinDefend with stop keyword from non-SYSTEM account; service stop event correlation in kql/spl queries
Directly modifies the DisableAntiSpyware registry value under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender to simulate a registry-level access control bypass, as would be possible if CVE-2026-33825 allows writing to policy-controlled Defender registry paths.
Command
reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d 1 /fCleanup
reg.exe delete "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /fExpected Telemetry
Sysmon EventID 13 (registry value set) with TargetObject HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware and Details=DWORD (0x00000001); Security EventID 4657 for registry write to Defender policy key; Defender Operational EventID 5007
Expected Detection
Registry hunting query should surface DisableAntiSpyware=1 modification; kql and spl registry modification detections should alert on this specific key/value combination