Query: detection rule: Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some importan
Matching passage: Sigma rule: Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some importan. Logsource: windows / process_creation. Rule: title: Suspicious Windows Defender Registry Key Tampering Via Reg.EXE id: 452bce90-6fb0-43cc-97a5-affc283139b3 status: test description: 'Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some important features related to protection and detection ' references: - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/ - https://github.com/swagkarna/Defeat-Defender-V1.2.0/tree/ae4059c4276da6f6303b8f53cdff085ecae88a91 - https://www.elevenforum.com/t/video-guide-how-to-completely-disable-microsoft-defender-antivirus.14608/page-2 - https://tria.ge/241231-j9yatstqbm/behavioral1 author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems) date: 2022-03-22 modified: 2025-06-04 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_root_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_root_path: CommandLine|contains: - SOFTWARE\Microsoft\Windows Defender\ - SOFTWARE\Policies\Microsoft\Windows Defender Security Center - SOFTWARE\Policies\Microsoft\Windows Defender\ selection_dword_0: CommandLine|contains|all: - ' add ' - d 0 CommandLine|contains: - DisallowExploitProtectionOverride - EnableControlledFolderAccess - MpEnablePus - PUAProtection - SpynetReporting - SubmitSamplesConsent - TamperProtection selection_dword_1: CommandLine|contains|all: - ' add ' - d 1 CommandLine|contains: - DisableAccess - DisableAntiSpyware - DisableAntiSpywareRealtimeProtection - DisableAntiVirus - DisableAntiVirusSignatures - DisableArchiveScanning - DisableBehaviorMonitoring - DisableBlockAtFirstSeen - DisableCloudProtection - DisableConfig - DisableEnhancedNotifications - DisableIntrusionPreventionSystem - DisableIOAVProtection - DisableNetworkProtection - DisableOnAccessProtection - DisablePrivacyMode - DisableRealtimeMonitoring - DisableRoutinelyTakingAction - DisableScanOnRealtimeEnable - DisableScriptScanning - DisableSecurityCenter - Notification_Suppress - SignatureDisableUpdateOnStartupWithoutEngine condition: all of selection_root_* and 1 of selection_dword_* falsepositives: - Rare legitimate use by administrators to test software (should always be investigated) level: high
Near-miss passage: Sigma rule: Adversaries may carry out malicious operations using a virtual instance to avoid detection. Logsource: windows / ps_script. Rule: title: Suspicious Hyper-V Cmdlets id: 42d36aa1-3240-4db0-8257-e0118dcdd9cd status: test description: Adversaries may carry out malicious operations using a virtual instance to avoid detection references: - https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.006/T1564.006.md#atomic-test-3---create-and-start-hyper-v-virtual-machine author: frack113 date: 2022-04-09 tags: - attack.stealth - attack.t1564.006 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - New-VM - Set-VMFirmware - Start-VM condition: selection falsepositives: - Legitimate PowerShell scripts level: medium