Convert indexed Sigma rules into analyst-ready detections.

title: Potential HackTool - Defendnot Security Center AV Registry Modification
id: 9991c683-05aa-47b7-a865-df14dc4b9dc4
status: experimental
description: |
    Detects modification of the Microsoft Security Center AV registry keys, particularly those related with DisplayName, ProductEXE, or ReportingExe.
    These keys typically store information about antivirus products installed on the system, which is Windows Defender or third-party antivirus software.
    But, if these keys holds unexpected values or are modified in a suspicious manner, it could indicate an attempt to tamper with the security settings of the system.
references:
    - https://www.huntress.com/blog/defendnot-detecting-malicious-security-product-bypass-techniques
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-10-18
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Software\Microsoft\Security Center\Provider\Av\'
        TargetObject|endswith:
            - '\ProductEXE'
            - '\DisplayName'
            - '\ReportingExe'
    filter_optional_antivirus:
        Image: 'C:\Windows\System32\svchost.exe'
        Details|contains:
            - 'Avira'
            - 'Windows Defender'
            - 'Microsoft Defender'
            - 'Sophos'
            - 'Kaspersky'
            - 'ESET'
            - 'Bitdefender'
            - 'Trend Micro'
            - 'McAfee'
            - 'Symantec'
            - 'CrowdStrike'
            - 'SentinelOne'
            - 'Carbon Black'
            - 'Elastic'
            - 'Cortex'
            - 'AVG'
            - 'Avast'
            - 'Malwarebytes'
    condition: selection and not 1 of filter_optional_*
falsepositives:
    - Legitimate changes by antivirus software missing in the filter list
level: medium # Update to high after baselining the rule and trimming false positives