Windows: reg.exe Registry Tampering of Windows Defender Policy Keys

Detects reg.exe adding Defender DWORD policy values to disable or suppress multiple protection features via Windows registry.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-03-22
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation where reg.exe is used to modify Windows Defender-related registry paths under both default and policy locations. The matched command lines add DWORD values associated with multiple Defender protection, reporting, and tamper protection settings, which is consistent with attempts to weaken endpoint defenses. It relies on telemetry from Windows process creation, including the process image and full command line content, to identify the specific registry targets and the presence of disabling-related DWORD operations.

Reporting behind it

Related detections9 linkedT1685 — drag to rearrange

Suspicious Termination of Defender Tray Process via Taskkill

Malicious Windows Defender Disablement via MpCmdRun RemoveDefinitions

Malicious Unsigned VIB Installation on ESXi Host via esxcli (via process_creation)

Suspicious In-Memory PowerShell Execution from Web Server via Automation Assembly (via image_load)

Malicious EDR Evasion Driver Load from AnyDesk Directory via k.sys (via image_load)

Malicious Zemana Vulnerable Driver Load for EDR Termination (via image_load)

Suspicious EDRKillShifter Vulnerable Driver Load from User Temp Directory (via image_load)

Malicious AuKill EDR Killer Kernel Driver Load via Process Explorer Driver (via image_load)

Malicious FIN7 AvNeutralizer EDR Killer Execution via Masqueraded Binary (via process_creation)

Windows: reg.exe Registry Tampering of Windows Defender Policy Keys

Pivot detection · T1685 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-reg-exe-registry-tampering-of-windows-defender-policy-keys-452bce90

title: "Windows: reg.exe Registry Tampering of Windows Defender Policy Keys"
id: 5f6522ad-8e99-406a-85ac-29dffb4a20e7
status: test
description: This rule flags process creation where reg.exe is used to modify Windows Defender-related registry paths under both default and policy locations. The matched command lines add DWORD values associated with multiple Defender protection, reporting, and tamper protection settings, which is consistent with attempts to weaken endpoint defenses. It relies on telemetry from Windows process creation, including the process image and full command line content, to identify the specific registry targets and the presence of disabling-related DWORD operations.
references:
  - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
  - https://github.com/swagkarna/Defeat-Defender-V1.2.0/tree/ae4059c4276da6f6303b8f53cdff085ecae88a91
  - https://www.elevenforum.com/t/video-guide-how-to-completely-disable-microsoft-defender-antivirus.14608/page-2
  - https://tria.ge/241231-j9yatstqbm/behavioral1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_windows_defender_tamper.yml
author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-03-22
modified: 2025-06-04
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection_root_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_root_path:
    CommandLine|contains:
      - SOFTWARE\Microsoft\Windows Defender\
      - SOFTWARE\Policies\Microsoft\Windows Defender Security Center
      - SOFTWARE\Policies\Microsoft\Windows Defender\
  selection_dword_0:
    CommandLine|contains|all:
      - " add "
      - d 0
    CommandLine|contains:
      - DisallowExploitProtectionOverride
      - EnableControlledFolderAccess
      - MpEnablePus
      - PUAProtection
      - SpynetReporting
      - SubmitSamplesConsent
      - TamperProtection
  selection_dword_1:
    CommandLine|contains|all:
      - " add "
      - d 1
    CommandLine|contains:
      - DisableAccess
      - DisableAntiSpyware
      - DisableAntiSpywareRealtimeProtection
      - DisableAntiVirus
      - DisableAntiVirusSignatures
      - DisableArchiveScanning
      - DisableBehaviorMonitoring
      - DisableBlockAtFirstSeen
      - DisableCloudProtection
      - DisableConfig
      - DisableEnhancedNotifications
      - DisableIntrusionPreventionSystem
      - DisableIOAVProtection
      - DisableNetworkProtection
      - DisableOnAccessProtection
      - DisablePrivacyMode
      - DisableRealtimeMonitoring
      - DisableRoutinelyTakingAction
      - DisableScanOnRealtimeEnable
      - DisableScriptScanning
      - DisableSecurityCenter
      - Notification_Suppress
      - SignatureDisableUpdateOnStartupWithoutEngine
  condition: all of selection_root_* and 1 of selection_dword_*
falsepositives:
  - Rare legitimate use by administrators to test software (should always be investigated)
level: high
license: DRL-1.1
related:
  - id: 452bce90-6fb0-43cc-97a5-affc283139b3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL