Sigma rule: Delete Defender Scan ShellEx Context Menu Registry Key
A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-acf8669256b0, updated 2025-10-07T00:00:00.000Z.
Rule
- Title
- Delete Defender Scan ShellEx Context Menu Registry Key
- Status
- experimental
- Level
- medium
- Author
- Matt Anderson (Huntress)
- Date
- 2025-07-11
- Modified
- 2025-10-07
- File
- rules/windows/registry/registry_delete/registry_delete_defender_context_menu.yml
- Commit
- ccbb0369507f796db0b0ae6854c8a2be471b9d84
Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make it harder for users to scan files that are suspicious.
Log source
- product
- windows
- category
- registry_delete
Detection
selection:
TargetObject|contains: 'shellex\ContextMenuHandlers\EPP'
filter_main_defender:
Image|startswith:
- 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
- 'C:\Program Files\Windows Defender\'
- 'C:\Program Files (x86)\Windows Defender\'
Image|endswith: '\MsMpEng.exe'
condition: selection and not 1 of filter_main_*False positives (as the rule lists them)
- Unlikely as this weakens defenses and normally would not be done even if using another AV.
Tags
- attack.defense-impairment
Related rules
References
- https://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/
- https://winaero.com/how-to-delete-scan-with-windows-defender-from-context-menu-in-windows-10/
- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_delete/registry_delete_defender_context_menu.yml
Sources and licences
SigmaHQ
"Delete Defender Scan ShellEx Context Menu Registry Key" by Matt Anderson (Huntress) (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_delete/registry_delete_defender_context_menu.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Cite this page
Dragons Eye Ransomware Tracker, "Sigma rule: Delete Defender Scan ShellEx Context Menu Registry Key",
entity page, dataset version ref-acf8669256b0, updated 2025-10-07T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/72a0369a-2576-4aaf-bfc9-6bb24a574ac6 (accessed 2026-11-03).
Underlying source: SigmaHQ rule 72a0369a-2576-4aaf-bfc9-6bb24a574ac6, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.
Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.