Potential HackTool - Defendnot Security Center AV Registry Modification

SIGMA detection rule by Swachchhanda Shrawan Poudel (Nextron Systems) · Unknown

Detects modification of the Microsoft Security Center AV registry keys, particularly those related with DisplayName, ProductEXE, or ReportingExe. These keys typically store information about antivirus products installed on the system, which is Windows Defender or third-party antivirus software. But, if these keys holds unexpected values or are modified in a suspicious manner, it could indicate an attempt to tamper with the security settings of the system.

title: Potential HackTool - Defendnot Security Center AV Registry Modification
id: 9991c683-05aa-47b7-a865-df14dc4b9dc4
status: experimental
description: |
    Detects modification of the Microsoft Security Center AV registry keys, particularly those related with DisplayName, ProductEXE, or ReportingExe.
    These keys typically store information about antivirus products installed on the system, which is Windows Defender or third-party antivirus software.
    But, if these keys holds unexpected values or are modified in a suspicious manner, it could indicate an attempt to tamper with the security settings of the system.
references:
    - https://www.huntress.com/blog/defendnot-detecting-malicious-security-product-bypass-techniques
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-10-18
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Software\Microsoft\Security Center\Provider\Av\'
        TargetObject|endswith:
            - '\ProductEXE'
            - '\DisplayName'
            - '\ReportingExe'
    filter_optional_antivirus:
        Image: 'C:\Windows\System32\svchost.exe'
        Details|contains:
            - 'Avira'
            - 'Windows Defender'
            - 'Microsoft Defender'
            - 'Sophos'
            - 'Kaspersky'
            - 'ESET'
            - 'Bitdefender'
            - 'Trend Micro'
            - 'McAfee'
            - 'Symantec'
            - 'CrowdStrike'
            - 'SentinelOne'
            - 'Carbon Black'
            - 'Elastic'
            - 'Cortex'
            - 'AVG'
            - 'Avast'
            - 'Malwarebytes'
    condition: selection and not 1 of filter_optional_*
falsepositives:
    - Legitimate changes by antivirus software missing in the filter list
level: medium # Update to high after baselining the rule and trimming false positives

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

a9ed897c-ff57-48d3-9c3b-ef66dacb268c

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion