Bypass Record

Tamper-Protection Bypass × Microsoft Windows Tamper Protection

A publicly-reported instance of Tamper-Protection Bypass bypassing Microsoft Windows Tamper Protection, recorded with its original source. Factual record; no assessment of any specific deployment.

Product
Microsoft Windows Tamper Protection
Technique
Tamper-Protection Bypass
MITRE ATT&CK
T1562.001
Confidence
High
Severity
High
Status
poc
Disclosed
2025-11-13
Config / version noted
Not stated

Provenance

Reported as

discovered a method to disable Windows Tamper Protection with physical access

Mechanism

With physical access to the device, the attacker disables Tamper Protection (not possible via HID attacks), then establishes a C2 connection to a cloud VPS for remote shell access. This defeats the protection that normally blocks scripted/automated disabling of Microsoft Defender and other security settings.

Detection & mitigation

Monitor for unexpected changes to Microsoft Defender Tamper Protection state via Windows Event ID 5007 (Microsoft Defender Antivirus Configuration Change) or registry modifications to HKLM\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection. Mitigate by enforcing physical security controls, using BitLocker with pre-boot authentication, and enabling attack surface reduction rules to block unauthorized processes.

Tamper-Protection Bypass has also been recorded against

This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.