Windows: reg.exe Registry Tampering of Windows Defender Policy Keys

title: "Windows: reg.exe Registry Tampering of Windows Defender Policy Keys"
id: 5f6522ad-8e99-406a-85ac-29dffb4a20e7
status: test
description: This rule flags process creation where reg.exe is used to modify Windows Defender-related registry paths under both default and policy locations. The matched command lines add DWORD values associated with multiple Defender protection, reporting, and tamper protection settings, which is consistent with attempts to weaken endpoint defenses. It relies on telemetry from Windows process creation, including the process image and full command line content, to identify the specific registry targets and the presence of disabling-related DWORD operations.
references:
  - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
  - https://github.com/swagkarna/Defeat-Defender-V1.2.0/tree/ae4059c4276da6f6303b8f53cdff085ecae88a91
  - https://www.elevenforum.com/t/video-guide-how-to-completely-disable-microsoft-defender-antivirus.14608/page-2
  - https://tria.ge/241231-j9yatstqbm/behavioral1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_windows_defender_tamper.yml
author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-03-22
modified: 2025-06-04
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: process_creation
  product: windows
detection:
  selection_root_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_root_path:
    CommandLine|contains:
      - SOFTWARE\Microsoft\Windows Defender\
      - SOFTWARE\Policies\Microsoft\Windows Defender Security Center
      - SOFTWARE\Policies\Microsoft\Windows Defender\
  selection_dword_0:
    CommandLine|contains|all:
      - " add "
      - d 0
    CommandLine|contains:
      - DisallowExploitProtectionOverride
      - EnableControlledFolderAccess
      - MpEnablePus
      - PUAProtection
      - SpynetReporting
      - SubmitSamplesConsent
      - TamperProtection
  selection_dword_1:
    CommandLine|contains|all:
      - " add "
      - d 1
    CommandLine|contains:
      - DisableAccess
      - DisableAntiSpyware
      - DisableAntiSpywareRealtimeProtection
      - DisableAntiVirus
      - DisableAntiVirusSignatures
      - DisableArchiveScanning
      - DisableBehaviorMonitoring
      - DisableBlockAtFirstSeen
      - DisableCloudProtection
      - DisableConfig
      - DisableEnhancedNotifications
      - DisableIntrusionPreventionSystem
      - DisableIOAVProtection
      - DisableNetworkProtection
      - DisableOnAccessProtection
      - DisablePrivacyMode
      - DisableRealtimeMonitoring
      - DisableRoutinelyTakingAction
      - DisableScanOnRealtimeEnable
      - DisableScriptScanning
      - DisableSecurityCenter
      - Notification_Suppress
      - SignatureDisableUpdateOnStartupWithoutEngine
  condition: all of selection_root_* and 1 of selection_dword_*
falsepositives:
  - Rare legitimate use by administrators to test software (should always be investigated)
level: high
license: DRL-1.1
related:
  - id: 452bce90-6fb0-43cc-97a5-affc283139b3
    type: derived