Suspicious Antivirus Registration

[rule]
description = "Identifies attempts to disable Windows Defender via registering a rogue anti-virus."
id = "38deccde-475d-4d1d-a4a2-50168fdc6c18"
license = "Elastic License v2"
name = "Suspicious Antivirus Registration"
os_list = ["windows"]
reference = ["https://blog.es3n1n.eu/posts/how-i-ruined-my-vacation/"]
version = "1.0.3"

query = '''
registry where event.action == "modification" and process.executable : "C:\\Windows\\System32\\svchost.exe" and
 registry.value : "REPORTINGEXE" and registry.path : "HKLM\\SOFTWARE\\Microsoft\\Security Center\\Provider\\Av\\{*}\\REPORTINGEXE" and
 registry.data.strings : "C:\\Windows\\System32\\*.exe"
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"

[[threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.10.0"