LoFP / legitimate changes by antivirus software missing in the filter list

Techniques

• t1685

Sample rules

Potential HackTool - Defendnot Security Center AV Registry Modification

• source: sigma
• technicques:
  • t1685

Description

Detects modification of the Microsoft Security Center AV registry keys, particularly those related with DisplayName, ProductEXE, or ReportingExe. These keys typically store information about antivirus products installed on the system, which is Windows Defender or third-party antivirus software. But, if these keys holds unexpected values or are modified in a suspicious manner, it could indicate an attempt to tamper with the security settings of the system.

Detection logic

condition: selection and not 1 of filter_optional_*
filter_optional_antivirus:
  Details|contains:
  - Avira
  - Windows Defender
  - Microsoft Defender
  - Sophos
  - Kaspersky
  - ESET
  - Bitdefender
  - Trend Micro
  - McAfee
  - Symantec
  - CrowdStrike
  - SentinelOne
  - Carbon Black
  - Elastic
  - Cortex
  - AVG
  - Avast
  - Malwarebytes
  Image: C:\Windows\System32\svchost.exe
selection:
  TargetObject|contains: \Software\Microsoft\Security Center\Provider\Av\
  TargetObject|endswith:
  - \ProductEXE
  - \DisplayName
  - \ReportingExe