Delete Defender Scan ShellEx Context Menu Registry Key

Status: experimental
Severity: medium
Log source: category registry_delete, product windows
Author: Matt Anderson (Huntress)
Source: github.com/SigmaHQ/sigma

Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make it harder for users to scan files that are suspicious.

Known false positives

Unlikely as this weakens defenses and normally would not be done even if using another AV.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 14: RegistryEvent (Key and Value Rename)

Rule body

title: Delete Defender Scan ShellEx Context Menu Registry Key
id: 72a0369a-2576-4aaf-bfc9-6bb24a574ac6
related:
    - id: b9e8c7d6-a5f4-4e3d-8b1a-9f0c8d7e6a5b
      type: similar
status: experimental
description: Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make it harder for users to scan files that are suspicious.
references:
    - https://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/
    - https://winaero.com/how-to-delete-scan-with-windows-defender-from-context-menu-in-windows-10/
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
    - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
author: 'Matt Anderson (Huntress)'
date: 2025-07-11
modified: 2025-10-07
tags:
    - attack.defense-impairment
logsource:
    category: registry_delete
    product: windows
detection:
    selection:
        TargetObject|contains: 'shellex\ContextMenuHandlers\EPP'
    filter_main_defender:
        Image|startswith:
            - 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
            - 'C:\Program Files\Windows Defender\'
            - 'C:\Program Files (x86)\Windows Defender\'
        Image|endswith: '\MsMpEng.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely as this weakens defenses and normally would not be done even if using another AV.
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    TargetObject|contains: 'shellex\ContextMenuHandlers\EPP'

Stage 2: `not filter_main_defender`

filter_main_defender:
    Image|startswith:
        - 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
        - 'C:\Program Files\Windows Defender\'
        - 'C:\Program Files (x86)\Windows Defender\'
    Image|endswith: '\MsMpEng.exe'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	starts_with	`C:\Program Files (x86)\Windows Defender\`	`excludes:Image` `field:"Image" value:"C:\Program Files (x86)\Windows Defender\"`
`Image`	starts_with	`C:\Program Files\Windows Defender\`	`excludes:Image` `field:"Image" value:"C:\Program Files\Windows Defender\"`
`Image`	starts_with	`C:\ProgramData\Microsoft\Windows Defender\Platform\`	`excludes:Image` `field:"Image" value:"C:\ProgramData\Microsoft\Windows Defender\Platform\"`
`Image`	ends_with	`\MsMpEng.exe`	`excludes:Image` `field:"Image" value:"\MsMpEng.exe"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetObject`	match	`shellex\ContextMenuHandlers\EPP`	`field:"TargetObject" kind:match value:"shellex\ContextMenuHandlers\EPP"`