Potential HackTool - Defendnot Security Center AV Registry Modification

 1title: Potential HackTool - Defendnot Security Center AV Registry Modification
 2id: 9991c683-05aa-47b7-a865-df14dc4b9dc4
 3status: experimental
 4description: |
 5    Detects modification of the Microsoft Security Center AV registry keys, particularly those related with DisplayName, ProductEXE, or ReportingExe.
 6    These keys typically store information about antivirus products installed on the system, which is Windows Defender or third-party antivirus software.
 7    But, if these keys holds unexpected values or are modified in a suspicious manner, it could indicate an attempt to tamper with the security settings of the system.    
 8references:
 9    - https://www.huntress.com/blog/defendnot-detecting-malicious-security-product-bypass-techniques
10author: Swachchhanda Shrawan Poudel (Nextron Systems)
11date: 2026-10-18
12tags:
13    - attack.defense-impairment
14    - attack.t1685
15logsource:
16    category: registry_set
17    product: windows
18detection:
19    selection:
20        TargetObject|contains: '\Software\Microsoft\Security Center\Provider\Av\'
21        TargetObject|endswith:
22            - '\ProductEXE'
23            - '\DisplayName'
24            - '\ReportingExe'
25    filter_optional_antivirus:
26        Image: 'C:\Windows\System32\svchost.exe'
27        Details|contains:
28            - 'Avira'
29            - 'Windows Defender'
30            - 'Microsoft Defender'
31            - 'Sophos'
32            - 'Kaspersky'
33            - 'ESET'
34            - 'Bitdefender'
35            - 'Trend Micro'
36            - 'McAfee'
37            - 'Symantec'
38            - 'CrowdStrike'
39            - 'SentinelOne'
40            - 'Carbon Black'
41            - 'Elastic'
42            - 'Cortex'
43            - 'AVG'
44            - 'Avast'
45            - 'Malwarebytes'
46    condition: selection and not 1 of filter_optional_*
47falsepositives:
48    - Legitimate changes by antivirus software missing in the filter list
49level: medium # Update to high after baselining the rule and trimming false positives