Microsoft Fixes False 'Defender Antivirus Is Turned Off' Alerts — How to Validate Real AV Tampering vs. Bug Noise

Microsoft has resolved a known issue that caused Windows to incorrectly warn users and administrators that Microsoft Defender Antivirus was turned off after installing recent updates. On the surface, this sounds like a cosmetic bug — and functionally, it is. But from a SOC and incident response perspective, this class of defect is more dangerous than it appears: false 'security control disabled' alerts train analysts to ignore real ones.

When an endpoint genuinely has Defender disabled — whether through malware tampering, an attacker with local admin rights, or a misconfigured GPO — the telemetry looks nearly identical to what this bug produced. During the window where this known issue was active, any analyst who normalized 'Defender is off' warnings as noise created a blind spot that a real intruder could hide inside. Alert fatigue is not an abstract concept; it is an operational vulnerability.

This post breaks down what happened, why it matters to defenders, how to verify the true state of Defender Antivirus across your fleet, and how to build detections that distinguish a genuine tamper event from a platform bug.

Technical Analysis

What Happened

Per the BleepingComputer report, Microsoft confirmed a known issue in which devices displayed incorrect warnings that Defender Antivirus was turned off following the installation of recent updates. The alerts were false positives generated by the operating system's security state reporting, not an actual change to the Defender service or real-time protection configuration. Microsoft has since rolled out a resolution.

Key characteristics of this bug class:

• The reporting layer lied, not the protection layer. In these cases, the Windows Security Center / Action Center (or the MDM-reported compliance state) reflects an incorrect status while MsMpEng.exe and the WinDefend service continue running normally.
• Trigger condition: post-update state. Bugs like this typically emerge when an update modifies how the security provider registers with Windows Security Center (WMI namespace root\SecurityCenter2), leaving stale or missing provider registrations.
• No CVE was assigned. This is a reliability defect, not an exploitable vulnerability. There is no CVSS score, no KEV entry, and no evidence of malicious exploitation of the bug itself.

Why Defenders Should Still Care

The indirect risk is real and well-documented in incident response work:

1. Tampering is a canonical attacker technique. MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools is one of the most common pre-ransomware behaviors we see in IR engagements. Ransomware operators routinely attempt Set-MpPreference -DisableRealtimeMonitoring $true, registry writes to HKLM\SOFTWARE\Policies\Microsoft\Windows Defender, or direct service manipulation before staging encryption.
2. False alerts desensitize the SOC. If your team saw dozens of 'Defender is off' events during the bug window and dismissed them wholesale, a genuine tamper event during the same period could have been closed as a duplicate.
3. Compliance exposure. Under CIS Control 8 and various framework requirements (PCI-DSS Req. 5, HIPAA Security Rule), AV operational status is an auditable control. Incorrect reporting can create false audit findings — or worse, mask real ones.

Exploitation Status

There is no exploit, PoC, or active abuse of this bug — it is a reporting defect. The threat to defend against is the lookalike: real Defender tampering that resembles the bug's output.

Detection & Response

The correct defensive response to this news is twofold: (1) hunt for any real Defender disablement that may have been dismissed during the bug window, and (2) ensure your detections for T1562.001 remain healthy and weren't tuned down.

Sigma Rules

These rules target genuine tamper behaviors — registry-based disablement and abuse of Defender's own PowerShell module — rather than the bug's false telemetry.

---
title: Defender Antivirus Disabled via Registry Policy Key
id: 3f8c2a17-9b4e-4d61-a502-7e1c5f9d8b2a
status: experimental
description: Detects registry writes that disable Microsoft Defender Antivirus or real-time protection via policy keys, a common pre-ransomware tamper technique (T1562.001).
references:
  - https://attack.mitre.org/techniques/T1562/001/
  - https://www.bleepingcomputer.com/news/security/microsoft-fixes-bug-behind-defender-antivirus-is-turned-off-alerts/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware'
      - '\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring'
      - '\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring'
  selection_value:
    Details|contains: '0x00000001'
  condition: selection_key and selection_value
falsepositives:
  - Enterprise GPOs intentionally disabling Defender in favor of a third-party AV (verify change tickets)
  - Co-managed environments during AV migration projects
level: high
---
title: Defender Tampering via PowerShell Set-MpPreference
id: 8b1d4e62-3c7a-4f95-b308-2a6d9c1e5f47
status: experimental
description: Detects use of Set-MpPreference or Add-MpPreference to disable real-time monitoring, behavior monitoring, or add broad exclusions — a hallmark of hands-on-keyboard intrusions and malware staging.
references:
  - https://attack.mitre.org/techniques/T1562/001/
  - https://www.bleepingcomputer.com/news/security/microsoft-fixes-bug-behind-defender-antivirus-is-turned-off-alerts/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\powershell_ise.exe'
  selection_cli:
    CommandLine|contains:
      - 'DisableRealtimeMonitoring'
      - 'DisableBehaviorMonitoring'
      - 'DisableIOAVProtection'
      - 'DisableScriptScanning'
      - 'DisableAntiSpyware'
      - 'Add-MpPreference -ExclusionPath'
      - 'Set-MpPreference -ExclusionPath'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate admin exclusion additions (should reference a change ticket; scope exclusions are high-risk)
  - Developer workstation exceptions — enforce via GPO/Intune instead of ad-hoc commands
level: high

KQL — Microsoft Sentinel / Defender

This query surfaces both the alert noise from the bug window (for retroactive review) and actual Defender health degradation from Defender for Endpoint device reporting, so you can confirm nothing real was dismissed as a bug.

// Part 1: Review all 'Defender turned off' style alerts from the bug window and their dispositions
AlertInfo
| where TimeGenerated >= ago(30d)
| where Title has_any ("Defender Antivirus is turned off", "Antivirus is turned off", "real-time protection")
| join kind=leftouter (AlertEvidence | summarize EvidenceCount = count() by AlertId) on AlertId
| project TimeGenerated, Title, Severity, Category, ServiceSource, EvidenceCount
| summarize AlertCount = count(), ClosedCount = countif(ServiceSource has "Defender") by Title, bin(TimeGenerated, 1d)
| sort by TimeGenerated desc;

// Part 2: Identify devices with genuinely degraded Defender state (run in Defender Advanced Hunting)
// Flags devices reporting real-time protection off, signature out of date, or service not running
DeviceInfo
| where TimeGenerated >= ago(7d)
| summarize arg_max(TimeGenerated, *) by DeviceId
| where OnboardingStatus == "Onboarded"
| project DeviceName, OSPlatform, TimeGenerated
| join kind=leftouter (
    DeviceTvmSecureConfigurationAssessment
    | where TimeGenerated >= ago(7d)
    | where ConfigurationId has "scid-" and ConfigurationName has "real-time protection"
    | summarize arg_max(TimeGenerated, *) by DeviceId
    | project DeviceId, IsCompliant, IsApplicable
) on DeviceId
| where IsCompliant == false
| project DeviceName, OSPlatform, IsCompliant, TimeGenerated
| sort by DeviceName asc

Velociraptor VQL

Use this artifact during triage on a host flagged with a 'Defender off' warning to establish ground truth: is the service actually running, and are tamper registry values present?

-- Establish ground truth on Defender operational state during 'AV turned off' alert triage
LET procs = SELECT Pid, Name, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'MsMpEng' OR Exe =~ 'MsMpEng.exe'

LET keys = SELECT FullPath, Name, Type, Data.value AS Value
FROM glob(globs='HKEY_LOCAL_MACHINE/SOFTWARE/Policies/Microsoft/Windows Defender/*', accessor='registry')
WHERE Name =~ 'DisableAntiSpyware|DisableRealtimeMonitoring|DisableAntiVirus'

SELECT * FROM procs

If MsMpEng.exe appears in the process list and no disable registry values exist, the alert was almost certainly the reporting bug, not tampering. If the process is absent or disable keys exist with value 1, escalate immediately.

Remediation / Verification Script

Run this on any endpoint that reported 'Defender Antivirus is turned off' to verify true protection state and confirm the device has current updates. Requires an elevated prompt.

# Verify true Defender Antivirus operational state (run elevated)
$status = Get-MpComputerStatus

[PSCustomObject]@{
    AMServiceEnabled        = $status.AMServiceEnabled
    AntivirusEnabled        = $status.AntivirusEnabled
    RealTimeProtection      = $status.RealTimeProtectionEnabled
    BehaviorMonitoring      = $status.BehaviorMonitorEnabled
    TamperProtection        = $status.IsTamperProtected
    SignatureAgeDays        = $status.AntivirusSignatureAge
    EngineVersion           = $status.AMEngineVersion
    AntispywareSigVersion   = $status.AntispywareSignatureVersion
} | Format-List

# Check the WinDefend service state directly (bypasses the buggy reporting layer)
Get-Service WinDefend, WdNisSvc, Sense | Select-Object Name, Status, StartType

# Check for tamper registry values that indicate REAL disablement (not the bug)
$paths = @(
    'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender',
    'HKLM:\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection'
)
foreach ($p in $paths) {
    if (Test-Path $p) {
        Get-ItemProperty $p | Select-Object DisableAntiSpyware, DisableRealtimeMonitoring, DisableAntiVirus
    }
}

# Confirm the device has the latest cumulative updates installed (bug was fixed via update)
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID, InstalledOn, Description

# Update signatures to eliminate stale-signature alert noise
Update-MpSignature

Interpretation guide: If RealTimeProtection is True, WinDefend is Running, and no disable keys exist — the alert was the bug, and the device is protected. If any of those checks fail, treat it as a genuine tamper event: isolate the host, collect triage artifacts, and review recent process execution and logon activity for intrusion indicators.

Remediation

1. Apply the fix via Windows Update. Microsoft resolved the known issue through its standard update channel. Ensure endpoints have installed the latest cumulative update for their Windows version. For WSUS/Intune-managed fleets, force a sync and verify update compliance on any device that triggered the false warning.
2. Retro-review alert dispositions. Query your SIEM/ticketing system for all 'Defender off' alerts closed during the bug window. Any closure without documented verification of Get-MpComputerStatus output should be re-opened and validated using the script above.
3. Do not suppress Defender health alerts. The correct response to noisy-but-important telemetry is tuning (deduplication, suppression windows tied to a known-issue KBA number), never blanket disablement of the detection.
4. Enforce Tamper Protection. Verify IsTamperProtected = True fleet-wide via Intune or GPO. Tamper Protection is the single most effective control against the real T1562.001 techniques this bug's alerts mimic.
5. Baseline your AV state reporting. Use the KQL queries above as a scheduled weekly hunt so genuine Defender degradation is caught within days, not discovered during an incident.
6. Reference: Microsoft documents known issues for each Windows release on the Windows Release Health dashboard; cross-reference the specific KBA for your OS build against the fix rollout.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub