Windows registry delete: remove ShellEx ContextMenuHandlers EPP key for "Scan with Defender"

Alerts when a registry key tied to the Defender “Scan with” context menu is deleted, excluding MsMpEng.exe activity.

FreeUnreviewedSigmamediumv1

windows-registry-delete-remove-shellex-contextmenuhandlers-epp-key-for-scan-with-72a0369a

title: 'Windows registry delete: remove ShellEx ContextMenuHandlers EPP key for "Scan with Defender"'
id: 222c8b3e-ae4e-4f4b-a3fc-0bf216a8b40c
related:
  - id: b9e8c7d6-a5f4-4e3d-8b1a-9f0c8d7e6a5b
    type: similar
  - id: 72a0369a-2576-4aaf-bfc9-6bb24a574ac6
    type: derived
status: experimental
description: This rule identifies deletion of a Windows registry key under ShellEx ContextMenuHandlers with an EPP-related path, which is associated with the "Scan with Defender" context menu option. Attackers can impair endpoint defenses by removing user-accessible scanning functionality. The rule relies on Windows registry delete events and correlates them with the deleting process image path, excluding cases where the activity is attributed to MsMpEng.exe from common Windows Defender locations.
references:
  - https://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/
  - https://winaero.com/how-to-delete-scan-with-windows-defender-from-context-menu-in-windows-10/
  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
  - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_delete/registry_delete_defender_context_menu.yml
author: Matt Anderson (Huntress), Huntrule Team
date: 2025-07-11
modified: 2025-10-07
tags:
  - attack.defense-impairment
logsource:
  category: registry_delete
  product: windows
detection:
  selection:
    TargetObject|contains: shellex\ContextMenuHandlers\EPP
  filter_main_defender:
    Image|startswith:
      - C:\ProgramData\Microsoft\Windows Defender\Platform\
      - C:\Program Files\Windows Defender\
      - C:\Program Files (x86)\Windows Defender\
    Image|endswith: \MsMpEng.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely as this weakens defenses and normally would not be done even if using another AV.
level: medium
license: DRL-1.1

What it detects

This rule identifies deletion of a Windows registry key under ShellEx ContextMenuHandlers with an EPP-related path, which is associated with the "Scan with Defender" context menu option. Attackers can impair endpoint defenses by removing user-accessible scanning functionality. The rule relies on Windows registry delete events and correlates them with the deleting process image path, excluding cases where the activity is attributed to MsMpEng.exe from common Windows Defender locations.

Known false positives

Unlikely as this weakens defenses and normally would not be done even if using another AV.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.