Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

Antivirus Filter Driver Disallowed On Dev Drive - Registry

Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
kostastsale, Nasreddine Bencherchali (Nextron Systems)Created Sun Nov 05Updated Fri Aug 1631e124fb-5dc4-42a0-83b3-44a69c77b271windows
Log Source
WindowsRegistry Set
ProductWindows← raw: windows
CategoryRegistry Set← raw: registry_set
Detection Logic
Detection Logic1 selector
detection:
    selection:
        TargetObject|endswith: '\FilterManager\FltmgrDevDriveAllowAntivirusFilter'
        Details: 'DWORD (0x00000000)'
    condition: selection
False Positives
Unlikely

False positives are unlikely for most environments. High confidence detection.

References
1
Resolving title…
twitter.com
MITRE ATT&CK
Rule Metadata
Rule ID
31e124fb-5dc4-42a0-83b3-44a69c77b271
Status
test
Level
high
Type
Detection
Created
Sun Nov 05
Modified
Fri Aug 16
Author
kostastsale, Nasreddine Bencherchali (Nextron Systems)
Path
rules/windows/registry/registry_set/registry_set_devdrv_disallow_antivirus_filter.yml
Raw Tags
attack.defense-evasionattack.t1562.001
View on GitHub