Sigma rule: Potential HackTool - Defendnot Security Center AV Registry Modification

Rule

Title

Potential HackTool - Defendnot Security Center AV Registry Modification

Status

experimental

Level

medium

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-10-18

File

rules/windows/registry/registry_set/registry_set_security_center_av_registry_modification.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects modification of the Microsoft Security Center AV registry keys, particularly those related with DisplayName, ProductEXE, or ReportingExe.
These keys typically store information about antivirus products installed on the system, which is Windows Defender or third-party antivirus software.
But, if these keys holds unexpected values or are modified in a suspicious manner, it could indicate an attempt to tamper with the security settings of the system.

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|contains: '\Software\Microsoft\Security Center\Provider\Av\'
    TargetObject|endswith:
        - '\ProductEXE'
        - '\DisplayName'
        - '\ReportingExe'
filter_optional_antivirus:
    Image: 'C:\Windows\System32\svchost.exe'
    Details|contains:
        - 'Avira'
        - 'Windows Defender'
        - 'Microsoft Defender'
        - 'Sophos'
        - 'Kaspersky'
        - 'ESET'
        - 'Bitdefender'
        - 'Trend Micro'
        - 'McAfee'
        - 'Symantec'
        - 'CrowdStrike'
        - 'SentinelOne'
        - 'Carbon Black'
        - 'Elastic'
        - 'Cortex'
        - 'AVG'
        - 'Avast'
        - 'Malwarebytes'
condition: selection and not 1 of filter_optional_*

False positives (as the rule lists them)

• Legitimate changes by antivirus software missing in the filter list

Tags

• attack.defense-impairment
• attack.t1685

MITRE ATT&CK ids this rule names

• T1685

References

• https://www.huntress.com/blog/defendnot-detecting-malicious-security-product-bypass-techniques

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_security_center_av_registry_modification.yml