{"id":"b9e8c7d6-a5f4-4e3d-8b1a-9f0c8d7e6a5b","title":"Windows Defender Context Menu Removed","description":"Detects the use of reg.exe or PowerShell to delete the Windows Defender context menu handler registry keys.\nThis action removes the \"Scan with Microsoft Defender\" option from the right-click menu for files, directories, and drives.\nAttackers may use this technique to hinder manual, on-demand scans and reduce the visibility of the security product.\n","author":"Matt Anderson (Huntress)","status":"experimental","level":"high","date":"2025-07-09","modified":"","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["May be part of a system customization or \"debloating\" script, but this is highly unusual in a managed corporate environment."],"references":["https://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/","https://winaero.com/how-to-delete-scan-with-windows-defender-from-context-menu-in-windows-10/","https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/","https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/"],"source_path":"rules/windows/process_creation/proc_creation_win_defender_remove_context_menu.yml","source_sha256":"6a8f710c83e3cd0d4efb0af70e6a437fe1e892dcd20dae2951e33ee976650a04","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_defender_remove_context_menu.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Windows Defender Context Menu Removed\nid: b9e8c7d6-a5f4-4e3d-8b1a-9f0c8d7e6a5b\nrelated:\n    - id: 72a0369a-2576-4aaf-bfc9-6bb24a574ac6\n      type: similar\nstatus: experimental\ndescription: |\n    Detects the use of reg.exe or PowerShell to delete the Windows Defender context menu handler registry keys.\n    This action removes the \"Scan with Microsoft Defender\" option from the right-click menu for files, directories, and drives.\n    Attackers may use this technique to hinder manual, on-demand scans and reduce the visibility of the security product.\nreferences:\n    - https://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/\n    - https://winaero.com/how-to-delete-scan-with-windows-defender-from-context-menu-in-windows-10/\n    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/\n    - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/\nauthor: 'Matt Anderson (Huntress)'\ndate: 2025-07-09\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '\\powershell_ise.exe'\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n              - '\\reg.exe'\n        - OriginalFileName:\n              - 'powershell_ise.EXE'\n              - 'PowerShell.EXE'\n              - 'pwsh.dll'\n              - 'reg.exe'\n    selection_action:\n        CommandLine|contains:\n            - 'del'\n            - 'Remove-Item'\n            - 'ri '\n    selection_reg_path:\n        CommandLine|contains: '\\shellex\\ContextMenuHandlers\\EPP'\n    condition: all of selection_*\nfalsepositives:\n    - May be part of a system customization or \"debloating\" script, but this is highly unusual in a managed corporate environment.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/b9e8c7d6-a5f4-4e3d-8b1a-9f0c8d7e6a5b.json","kind":"sigma"}