Windows registry delete: remove ShellEx ContextMenuHandlers EPP key for "Scan with Defender"
Alerts when a registry key tied to the Defender “Scan with” context menu is deleted, excluding MsMpEng.exe activity.
- Product
- windows
- Category
- registry_delete
- Author
- Matt Anderson (Huntress) (SigmaHQ), DRL 1.1
- Published
- 2025-07-11
- Updated
- 2026-07-30
What it detects
This rule identifies deletion of a Windows registry key under ShellEx ContextMenuHandlers with an EPP-related path, which is associated with the "Scan with Defender" context menu option. Attackers can impair endpoint defenses by removing user-accessible scanning functionality. The rule relies on Windows registry delete events and correlates them with the deleting process image path, excluding cases where the activity is attributed to MsMpEng.exe from common Windows Defender locations.
Reporting behind it
- research.splunk.comhttps://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/
- winaero.comhttps://winaero.com/how-to-delete-scan-with-windows-defender-from-context-menu-in-windows-10/
- thedfirreport.comhttps://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
- blog.malwarebytes.comhttps://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_delete/registry_delete_defender_context_menu.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: 'Windows registry delete: remove ShellEx ContextMenuHandlers EPP key for "Scan with Defender"'
id: 222c8b3e-ae4e-4f4b-a3fc-0bf216a8b40c
related:
- id: b9e8c7d6-a5f4-4e3d-8b1a-9f0c8d7e6a5b
type: similar
- id: 72a0369a-2576-4aaf-bfc9-6bb24a574ac6
type: derived
status: experimental
description: This rule identifies deletion of a Windows registry key under ShellEx ContextMenuHandlers with an EPP-related path, which is associated with the "Scan with Defender" context menu option. Attackers can impair endpoint defenses by removing user-accessible scanning functionality. The rule relies on Windows registry delete events and correlates them with the deleting process image path, excluding cases where the activity is attributed to MsMpEng.exe from common Windows Defender locations.
references:
- https://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/
- https://winaero.com/how-to-delete-scan-with-windows-defender-from-context-menu-in-windows-10/
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_delete/registry_delete_defender_context_menu.yml
author: Matt Anderson (Huntress), Huntrule Team
date: 2025-07-11
modified: 2025-10-07
tags:
- attack.defense-impairment
logsource:
category: registry_delete
product: windows
detection:
selection:
TargetObject|contains: shellex\ContextMenuHandlers\EPP
filter_main_defender:
Image|startswith:
- C:\ProgramData\Microsoft\Windows Defender\Platform\
- C:\Program Files\Windows Defender\
- C:\Program Files (x86)\Windows Defender\
Image|endswith: \MsMpEng.exe
condition: selection and not 1 of filter_main_*
falsepositives:
- Unlikely as this weakens defenses and normally would not be done even if using another AV.
level: medium
license: DRL-1.1