Suspicious Delete Defender Scan ShellEx Context Menu Registry Key (via registry_delete)

title: Suspicious Delete Defender Scan ShellEx Context Menu Registry Key (via registry_delete)
id: 2ddf7b1c-1c67-574f-8afd-b81eed9ca1ed
status: stable
description: This rule detects deletion of registry key that adds 'Scan with Defender' option in context menu. Adversaries may use this to make it harder for users to scan files that are suspicious.
references:
    - https://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/
    - https://winaero.com/how-to-delete-scan-with-windows-defender-from-context-menu-in-windows-10/
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
    - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
author: 'Huntrule Team'
date: 2026-01-31
tags:
    - attack.defense-impairment
    - attack.defense-evasion
    - attack.t1562.001
    - attack.t1112
logsource:
    category: registry_delete
    product: windows
detection:
    selection:
        TargetObject|contains: 'shellex\ContextMenuHandlers\EPP'
    filter_main_defender:
        Image|startswith:
            - 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
            - 'C:\Program Files\Windows Defender\'
            - 'C:\Program Files (x86)\Windows Defender\'
        Image|endswith: '\MsMpEng.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium