{"id":"e1aa95de-610a-427d-b9e7-9b46cfafbe6a","title":"Windows Defender Service Disabled - Registry","description":"Detects when an attacker or tool disables the  Windows Defender service (WinDefend) via the registry","author":"Ján Trenčanský, frack113, AlertIQ, Nasreddine Bencherchali","status":"test","level":"high","date":"2022-08-01","modified":"2024-03-25","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"product":"windows","category":"registry_set"},"falsepositives":["Administrator actions"],"references":["https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/","https://gist.github.com/anadr/7465a9fde63d41341136949f14c21105"],"source_path":"rules/windows/registry/registry_set/registry_set_disable_windows_defender_service.yml","source_sha256":"1d007c9754e29aca365a8d2512c0f48804a00f1d9c3cb60d0fc17d48ae1e3d6e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_disable_windows_defender_service.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Windows Defender Service Disabled - Registry\nid: e1aa95de-610a-427d-b9e7-9b46cfafbe6a\nstatus: test\ndescription: Detects when an attacker or tool disables the  Windows Defender service (WinDefend) via the registry\nreferences:\n    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/\n    - https://gist.github.com/anadr/7465a9fde63d41341136949f14c21105\nauthor: Ján Trenčanský, frack113, AlertIQ, Nasreddine Bencherchali\ndate: 2022-08-01\nmodified: 2024-03-25\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    product: windows\n    category: registry_set\ndetection:\n    selection:\n        TargetObject|endswith: '\\Services\\WinDefend\\Start'\n        Details: 'DWORD (0x00000004)'\n    condition: selection\nfalsepositives:\n    - Administrator actions\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/e1aa95de-610a-427d-b9e7-9b46cfafbe6a.json","kind":"sigma"}