Detectionmediumexperimental

Potential HackTool - Defendnot Security Center AV Registry Modification

Detects modification of the Microsoft Security Center AV registry keys, particularly those related with DisplayName, ProductEXE, or ReportingExe. These keys typically store information about antivirus products installed on the system, which is Windows Defender or third-party antivirus software. But, if these keys holds unexpected values or are modified in a suspicious manner, it could indicate an attempt to tamper with the security settings of the system.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Swachchhanda Shrawan Poudel (Nextron Systems)Created Sun Oct 189991c683-05aa-47b7-a865-df14dc4b9dc4windows

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection:
        TargetObject|contains: '\Software\Microsoft\Security Center\Provider\Av\'
        TargetObject|endswith:
            - '\ProductEXE'
            - '\DisplayName'
            - '\ReportingExe'
    filter_optional_antivirus:
        Image: 'C:\Windows\System32\svchost.exe'
        Details|contains:
            - 'Avira'
            - 'Windows Defender'
            - 'Microsoft Defender'
            - 'Sophos'
            - 'Kaspersky'
            - 'ESET'
            - 'Bitdefender'
            - 'Trend Micro'
            - 'McAfee'
            - 'Symantec'
            - 'CrowdStrike'
            - 'SentinelOne'
            - 'Carbon Black'
            - 'Elastic'
            - 'Cortex'
            - 'AVG'
            - 'Avast'
            - 'Malwarebytes'
    condition: selection and not 1 of filter_optional_*