Query: detect Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some importan in logs
Matching passage: Sigma rule: Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some importan. Logsource: windows / process_creation. Rule: title: Suspicious Windows Defender Registry Key Tampering Via Reg.EXE id: 452bce90-6fb0-43cc-97a5-affc283139b3 status: test description: 'Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some important features related to protection and detection ' references: - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/ - https://github.com/swagkarna/Defeat-Defender-V1.2.0/tree/ae4059c4276da6f6303b8f53cdff085ecae88a91 - https://www.elevenforum.com/t/video-guide-how-to-completely-disable-microsoft-defender-antivirus.14608/page-2 - https://tria.ge/241231-j9yatstqbm/behavioral1 author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems) date: 2022-03-22 modified: 2025-06-04 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_root_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_root_path: CommandLine|contains: - SOFTWARE\Microsoft\Windows Defender\ - SOFTWARE\Policies\Microsoft\Windows Defender Security Center - SOFTWARE\Policies\Microsoft\Windows Defender\ selection_dword_0: CommandLine|contains|all: - ' add ' - d 0 CommandLine|contains: - DisallowExploitProtectionOverride - EnableControlledFolderAccess - MpEnablePus - PUAProtection - SpynetReporting - SubmitSamplesConsent - TamperProtection selection_dword_1: CommandLine|contains|all: - ' add ' - d 1 CommandLine|contains: - DisableAccess - DisableAntiSpyware - DisableAntiSpywareRealtimeProtection - DisableAntiVirus - DisableAntiVirusSignatures - DisableArchiveScanning - DisableBehaviorMonitoring - DisableBlockAtFirstSeen - DisableCloudProtection - DisableConfig - DisableEnhancedNotifications - DisableIntrusionPreventionSystem - DisableIOAVProtection - DisableNetworkProtection - DisableOnAccessProtection - DisablePrivacyMode - DisableRealtimeMonitoring - DisableRoutinelyTakingAction - DisableScanOnRealtimeEnable - DisableScriptScanning - DisableSecurityCenter - Notification_Suppress - SignatureDisableUpdateOnStartupWithoutEngine condition: all of selection_root_* and 1 of selection_dword_* falsepositives: - Rare legitimate use by administrators to test software (should always be investigated) level: high
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52). Logsource: windows / registry_set. Rule: title: UAC Bypass Abusing Winsat Path Parsing - Registry id: 6597be7b-ac61-4ac8-bef4-d3ec88174853 status: test description: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Root\InventoryApplicationFile\winsat.exe| TargetObject|endswith: \LowerCaseLongPath Details|startswith: c:\users\ Details|endswith: \appdata\local\temp\system32\winsat.exe condition: selection falsepositives: - Unknown level: high