Defender Event ID 5004: Real-time protection config changed
The real-time protection configuration changedDefender event 5004 is logged when a real-time protection feature (on-access, behavior monitoring, downloads scanning…) changes configuration.
5004
- Event ID
- 5004
- Channel
- Microsoft-Windows-Windows Defender/Operational
- Provider
- Microsoft-Windows-Windows Defender
- Log file
- Microsoft-Windows-Windows Defender%4Operational.evtx
- Category
- Antimalware
- Default logging
- Logged by default
What event 5004 means
Event 5004 records a change to one of the real-time protection features, such as on-access scanning, behavior monitoring, scanning of downloads and attachments (IOAV) or network inspection. The event names the feature and its new configuration.
Turning off individual features (behavior monitoring, IOAV) weakens protection without triggering the more visible 5001, so review which feature changed.
When it is logged
Audit policy / configuration
None — logged by Microsoft Defender Antivirus.
Key fields
| Field | What it tells you |
|---|---|
| Feature Name | Real-time protection feature that changed. |
| Configuration | New configuration value of the feature. |
Common benign sources
- Policy updates from Intune / Group Policy, platform updates.
What attackers do that produces it
- Selectively disabling behavior monitoring or download scanning (for example with
Set-MpPreference).
Investigation tips
- Correlate with 5007 (registry-level details) and PowerShell logs for the command used.
- List which feature changed and to what; a feature switched off outside a policy refresh is the finding.
MITRE ATT&CK techniques
| Technique | Tactics |
|---|---|
| T1685 Disable or Modify Tools | Defense Impairment |
MITRE ATT&CK v19.2. Technique and tactic names are MITRE's.
Sigma rules for this event
No bundled SigmaHQ rule targets this event ID specifically. Rules on related events may still cover the activity.
Run these rules on your logs
Drop a .evtx file into the viewer: all 2,395 bundled SigmaHQ rules run locally in your browser. Nothing is uploaded.