Delete Defender Scan ShellEx Context Menu Registry Key
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make it harder for users to scan files that are suspicious.
Severity
Trouble
Rule Requirement
Criteria
Action1:
actionname = "Registry entry deleted" AND (OBJECTNAME contains "shellex\ContextMenuHandlers\EPP,shell\Windows.Defender.ContextMenu" AND ACCESSES = "objectdeleted,Deletekey" AND PROCESSNAME notcontains "Microsoft\Windows Defender\Platform" AND PROCESSNAME notcontains "Windows Defender" AND PROCESSNAME notendswith "\MsMpEng.exe")
select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.OBJECTNAME,Action1.USERNAME,Action1.DOMAIN,Action1.ACCESSLIST,Action1.ACCESSES
Detection
Execution Mode
realtime
Log Sources
Windows
Author
@Matt Anderson (Huntress)
