{"id":"0eb46774-f1ab-4a74-8238-1155855f2263","title":"Disable Windows Defender Functionalities Via Registry Keys","description":"Detects when attackers or tools disable Windows Defender functionalities via the Windows registry","author":"AlertIQ, Ján Trenčanský, frack113, Nasreddine Bencherchali, Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2022-08-01","modified":"2024-10-07","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"product":"windows","category":"registry_set"},"falsepositives":["Administrator actions via the Windows Defender interface","Third party Antivirus"],"references":["https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/","https://gist.github.com/anadr/7465a9fde63d41341136949f14c21105","https://admx.help/?Category=Windows_7_2008R2&Policy=Microsoft.Policies.WindowsDefender::SpyNetReporting","https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker","https://www.tenforums.com/tutorials/32236-enable-disable-microsoft-defender-pua-protection-windows-10-a.html","https://www.tenforums.com/tutorials/105533-enable-disable-windows-defender-exploit-protection-settings.html","https://www.tenforums.com/tutorials/123792-turn-off-tamper-protection-microsoft-defender-antivirus.html","https://securelist.com/key-group-ransomware-samples-and-telegram-schemes/114025/"],"source_path":"rules/windows/registry/registry_set/registry_set_windows_defender_tamper.yml","source_sha256":"50172efddeb1132fd7c59d05fe785a8b87a4f57e990af7f4e04f167c85f73661","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_windows_defender_tamper.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Disable Windows Defender Functionalities Via Registry Keys\nid: 0eb46774-f1ab-4a74-8238-1155855f2263\nrelated:\n    - id: a64e4198-c1c8-46a5-bc9c-324c86455fd4\n      type: obsolete\n    - id: fd115e64-97c7-491f-951c-fc8da7e042fa\n      type: obsolete\nstatus: test\ndescription: Detects when attackers or tools disable Windows Defender functionalities via the Windows registry\nreferences:\n    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/\n    - https://gist.github.com/anadr/7465a9fde63d41341136949f14c21105\n    - https://admx.help/?Category=Windows_7_2008R2&Policy=Microsoft.Policies.WindowsDefender::SpyNetReporting\n    - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker\n    - https://www.tenforums.com/tutorials/32236-enable-disable-microsoft-defender-pua-protection-windows-10-a.html\n    - https://www.tenforums.com/tutorials/105533-enable-disable-windows-defender-exploit-protection-settings.html\n    - https://www.tenforums.com/tutorials/123792-turn-off-tamper-protection-microsoft-defender-antivirus.html\n    - https://securelist.com/key-group-ransomware-samples-and-telegram-schemes/114025/\nauthor: AlertIQ, Ján Trenčanský, frack113, Nasreddine Bencherchali, Swachchhanda Shrawan Poudel\ndate: 2022-08-01\nmodified: 2024-10-07\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    product: windows\n    category: registry_set\ndetection:\n    selection_main:\n        TargetObject|contains:\n            - '\\SOFTWARE\\Microsoft\\Windows Defender\\'\n            - '\\SOFTWARE\\Policies\\Microsoft\\Windows Defender Security Center\\'\n            - '\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\'\n    selection_dword_1:\n        TargetObject|endswith:\n            - '\\DisableAntiSpyware'\n            - '\\DisableAntiVirus'\n            - '\\DisableBehaviorMonitoring'\n            - '\\DisableBlockAtFirstSeen'\n            - '\\DisableEnhancedNotifications'\n            - '\\DisableIntrusionPreventionSystem'\n            - '\\DisableIOAVProtection'\n            - '\\DisableOnAccessProtection'\n            - '\\DisableRealtimeMonitoring'\n            - '\\DisableScanOnRealtimeEnable'\n            - '\\DisableScriptScanning'\n        Details: 'DWORD (0x00000001)'\n    selection_dword_0:\n        TargetObject|endswith:\n            - '\\DisallowExploitProtectionOverride'\n            - '\\Features\\TamperProtection'\n            - '\\MpEngine\\MpEnablePus'\n            - '\\PUAProtection'\n            - '\\Signature Update\\ForceUpdateFromMU'\n            - '\\SpyNet\\SpynetReporting'\n            - '\\SpyNet\\SubmitSamplesConsent'\n            - '\\Windows Defender Exploit Guard\\Controlled Folder Access\\EnableControlledFolderAccess'\n        Details: 'DWORD (0x00000000)'\n    filter_optional_symantec:\n        Image|startswith: 'C:\\Program Files\\Symantec\\Symantec Endpoint Protection\\'\n        Image|endswith: '\\sepWscSvc64.exe'\n    condition: selection_main and 1 of selection_dword_* and not 1 of filter_optional_*\nfalsepositives:\n    - Administrator actions via the Windows Defender interface\n    - Third party Antivirus\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/0eb46774-f1ab-4a74-8238-1155855f2263.json","kind":"sigma"}