Sigma rule: Suspicious Windows Defender Registry Key Tampering Via Reg.EXE

A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-5c68507b62d7, updated 2025-06-04T00:00:00.000Z.

Rule

Title: Suspicious Windows Defender Registry Key Tampering Via Reg.EXE
Status: test
Level: high
Author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-03-22
Modified: 2025-06-04
File: rules/windows/process_creation/proc_creation_win_reg_windows_defender_tamper.yml
Commit: ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some important features related to protection and detection

Log source

product: windows
category: process_creation

Detection

selection_root_img:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'
selection_root_path:
    CommandLine|contains:
        - 'SOFTWARE\Microsoft\Windows Defender\'
        - 'SOFTWARE\Policies\Microsoft\Windows Defender Security Center'
        - 'SOFTWARE\Policies\Microsoft\Windows Defender\'
selection_dword_0:
    CommandLine|contains|all:
        - ' add '
        - 'd 0'
    CommandLine|contains:
        - 'DisallowExploitProtectionOverride'
        - 'EnableControlledFolderAccess'
        - 'MpEnablePus'
        - 'PUAProtection'
        - 'SpynetReporting'
        - 'SubmitSamplesConsent'
        - 'TamperProtection'
selection_dword_1:
    CommandLine|contains|all:
        - ' add '
        - 'd 1'
    CommandLine|contains:
        - 'DisableAccess'
        - 'DisableAntiSpyware'
        - 'DisableAntiSpywareRealtimeProtection'
        - 'DisableAntiVirus'
        - 'DisableAntiVirusSignatures'
        - 'DisableArchiveScanning'
        - 'DisableBehaviorMonitoring'
        - 'DisableBlockAtFirstSeen'
        - 'DisableCloudProtection'
        - 'DisableConfig'
        - 'DisableEnhancedNotifications'
        - 'DisableIntrusionPreventionSystem'
        - 'DisableIOAVProtection'
        - 'DisableNetworkProtection'
        - 'DisableOnAccessProtection'
        - 'DisablePrivacyMode'
        - 'DisableRealtimeMonitoring'
        - 'DisableRoutinelyTakingAction'
        - 'DisableScanOnRealtimeEnable'
        - 'DisableScriptScanning'
        - 'DisableSecurityCenter'
        - 'Notification_Suppress'
        - 'SignatureDisableUpdateOnStartupWithoutEngine'
condition: all of selection_root_* and 1 of selection_dword_*

False positives (as the rule lists them)

Rare legitimate use by administrators to test software (should always be investigated)

MITRE ATT&CK ids this rule names

T1685

References

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_reg_windows_defender_tamper.yml

Sources and licences

SigmaHQ
"Suspicious Windows Defender Registry Key Tampering Via Reg.EXE" by Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_reg_windows_defender_tamper.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "Sigma rule: Suspicious Windows Defender Registry Key Tampering Via Reg.EXE",
entity page, dataset version ref-5c68507b62d7, updated 2025-06-04T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/452bce90-6fb0-43cc-97a5-affc283139b3 (accessed 2026-11-03).
Underlying source: SigmaHQ rule 452bce90-6fb0-43cc-97a5-affc283139b3, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.