Windows Process Execution: Remove Windows Defender Context Menu Registry Keys via reg.exe/PowerShell

Alerts on reg.exe/PowerShell deleting Defender context menu handler registry keys to remove right-click scanning.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Matt Anderson (Huntress) (SigmaHQ), DRL 1.1
Published: 2025-07-09
Updated: 2026-07-31

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies executions of reg.exe and PowerShell (including PowerShell ISE) that delete registry entries under the Windows shell context menu handler path for Defender. Removing these handler keys disables the "Scan with Microsoft Defender" right-click option for files, directories, and drives. Attackers may use this defense-impairment technique to reduce opportunities for on-demand scanning and lower user visibility of the security product. The detection relies on process creation telemetry, including executable path/name and command-line content indicating deletion commands and the specific registry context menu handler location.

Reporting behind it

Related detections9 linkedT1685 — drag to rearrange

Malicious Unsigned VIB Installation on ESXi Host via esxcli (via process_creation)

Suspicious In-Memory PowerShell Execution from Web Server via Automation Assembly (via image_load)

Malicious EDR Evasion Driver Load from AnyDesk Directory via k.sys (via image_load)

Malicious Zemana Vulnerable Driver Load for EDR Termination (via image_load)

Suspicious EDRKillShifter Vulnerable Driver Load from User Temp Directory (via image_load)

Malicious AuKill EDR Killer Kernel Driver Load via Process Explorer Driver (via image_load)

Malicious FIN7 AvNeutralizer EDR Killer Execution via Masqueraded Binary (via process_creation)

Suspicious Process Explorer Kernel Driver Dropped as PED.sys via File Creation (via file_event)

Malicious Windows Defender Tampering via Set-MpPreference and Add-MpPreference (via ps_script)

Windows Process Execution: Remove Windows Defender Context Menu Registry Keys via reg.exe/PowerShell

Pivot detection · T1685 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-deletion-of-windows-defender-context-menu-registry-hand-b9e8c7d6

title: "Windows Process Execution: Remove Windows Defender Context Menu Registry Keys via reg.exe/PowerShell"
id: 8c66eb4f-e64d-4241-b030-1d898c48bf59
related:
  - id: 72a0369a-2576-4aaf-bfc9-6bb24a574ac6
    type: similar
  - id: b9e8c7d6-a5f4-4e3d-8b1a-9f0c8d7e6a5b
    type: derived
status: experimental
description: This rule identifies executions of reg.exe and PowerShell (including PowerShell ISE) that delete registry entries under the Windows shell context menu handler path for Defender. Removing these handler keys disables the "Scan with Microsoft Defender" right-click option for files, directories, and drives. Attackers may use this defense-impairment technique to reduce opportunities for on-demand scanning and lower user visibility of the security product. The detection relies on process creation telemetry, including executable path/name and command-line content indicating deletion commands and the specific registry context menu handler location.
references:
  - https://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/
  - https://winaero.com/how-to-delete-scan-with-windows-defender-from-context-menu-in-windows-10/
  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
  - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_defender_remove_context_menu.yml
author: Matt Anderson (Huntress), Huntrule Team
date: 2025-07-09
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell_ise.exe
        - \powershell.exe
        - \pwsh.exe
        - \reg.exe
    - OriginalFileName:
        - powershell_ise.EXE
        - PowerShell.EXE
        - pwsh.dll
        - reg.exe
  selection_action:
    CommandLine|contains:
      - del
      - Remove-Item
      - "ri "
  selection_reg_path:
    CommandLine|contains: \shellex\ContextMenuHandlers\EPP
  condition: all of selection_*
falsepositives:
  - May be part of a system customization or "debloating" script, but this is highly unusual in a managed corporate environment.
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL