Query: detect Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make i in logs
Matching passage: Sigma rule: Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make i. Logsource: windows / registry_delete. Rule: title: Delete Defender Scan ShellEx Context Menu Registry Key id: 72a0369a-2576-4aaf-bfc9-6bb24a574ac6 related: - id: b9e8c7d6-a5f4-4e3d-8b1a-9f0c8d7e6a5b type: similar status: experimental description: Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make it harder for users to scan files that are suspicious. references: - https://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/ - https://winaero.com/how-to-delete-scan-with-windows-defender-from-context-menu-in-windows-10/ - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ author: Matt Anderson (Huntress) date: 2025-07-11 modified: 2025-10-07 tags: - attack.defense-impairment logsource: category: registry_delete product: windows detection: selection: TargetObject|contains: shellex\ContextMenuHandlers\EPP filter_main_defender: Image|startswith: - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Program Files\Windows Defender\ - C:\Program Files (x86)\Windows Defender\ Image|endswith: \MsMpEng.exe condition: selection and not 1 of filter_main_* falsepositives: - Unlikely as this weakens defenses and normally would not be done even if using another AV. level: medium
Near-miss passage: Sigma rule: Detects the addition of new root, CA or AuthRoot certificates to the Windows registry. Logsource: windows / registry_set. Rule: title: New Root or CA or AuthRoot Certificate to Store id: d223b46b-5621-4037-88fe-fda32eead684 status: test description: Detects the addition of new root, CA or AuthRoot certificates to the Windows registry references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md#atomic-test-6---add-root-certificate-to-currentuser-certificate-store - https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec author: frack113 date: 2022-04-04 modified: 2023-08-17 tags: - attack.impact - attack.t1490 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\ - \SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\ - \SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\ - \SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\ - \SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates\ - \SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates\ - \SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\ - \SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot\Certificates\ - \SOFTWARE\Microsoft\EnterpriseCertificates\AuthRoot\Certificates\ TargetObject|endswith: \Blob Details: Binary Data condition: selection falsepositives: - Unknown level: medium