Windows Registry Tampering Targeting Sophos AV Tamper Protection Enabled Flags

Flags Windows registry changes that disable Sophos AV tamper protection by clearing specific enabled DWORD values.

FreeUnreviewedSigmahighv1

windows-registry-tampering-targeting-sophos-av-tamper-protection-enabled-flags-9f4662ac

title: Windows Registry Tampering Targeting Sophos AV Tamper Protection Enabled Flags
id: 6f202061-e7b8-4e97-a824-4da167b6654d
status: test
description: This rule identifies registry modifications that set specific Sophos AV tamper protection configuration values to DWORD 0x00000000. Disabling these protections can help attackers impair endpoint defenses and evade detection. It relies on Windows registry modification telemetry for registry set events matching targeted Sophos key paths and the expected zero value.
references:
  - https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_sophos_av_tamper.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-02
modified: 2023-08-17
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - \Sophos Endpoint Defense\TamperProtection\Config\SAVEnabled
      - \Sophos Endpoint Defense\TamperProtection\Config\SEDEnabled
      - \Sophos\SAVService\TamperProtection\Enabled
    Details: DWORD (0x00000000)
  condition: selection
falsepositives:
  - Some FP may occur when the feature is disabled by the AV itself, you should always investigate if the action was legitimate
level: high
license: DRL-1.1
related:
  - id: 9f4662ac-17ca-43aa-8f12-5d7b989d0101
    type: derived

What it detects

This rule identifies registry modifications that set specific Sophos AV tamper protection configuration values to DWORD 0x00000000. Disabling these protections can help attackers impair endpoint defenses and evade detection. It relies on Windows registry modification telemetry for registry set events matching targeted Sophos key paths and the expected zero value.

Known false positives

Some FP may occur when the feature is disabled by the AV itself, you should always investigate if the action was legitimate

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.