Detection rules › Sigma

Delete Defender Scan ShellEx Context Menu Registry Key

Status
experimental
Severity
medium
Log source
product windows, category registry_delete
Author
Matt Anderson (Huntress)
Source
github.com/SigmaHQ/sigma

Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make it harder for users to scan files that are suspicious.

MITRE ATT&CK coverage

TacticTechniques
Defense ImpairmentNo specific technique

Event coverage

ProviderEventTitle
SysmonEvent ID 14RegistryEvent (Key and Value Rename)

Rule body yaml

title: Delete Defender Scan ShellEx Context Menu Registry Key
id: 72a0369a-2576-4aaf-bfc9-6bb24a574ac6
related:
    - id: b9e8c7d6-a5f4-4e3d-8b1a-9f0c8d7e6a5b
      type: similar
status: experimental
description: Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make it harder for users to scan files that are suspicious.
references:
    - https://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/
    - https://winaero.com/how-to-delete-scan-with-windows-defender-from-context-menu-in-windows-10/
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
    - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
author: 'Matt Anderson (Huntress)'
date: 2025-07-11
modified: 2025-10-07
tags:
    - attack.defense-impairment
logsource:
    category: registry_delete
    product: windows
detection:
    selection:
        TargetObject|contains: 'shellex\ContextMenuHandlers\EPP'
    filter_main_defender:
        Image|startswith:
            - 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
            - 'C:\Program Files\Windows Defender\'
            - 'C:\Program Files (x86)\Windows Defender\'
        Image|endswith: '\MsMpEng.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely as this weakens defenses and normally would not be done even if using another AV.
level: medium

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_*

Stage 1: selection

selection:
    TargetObject|contains: 'shellex\ContextMenuHandlers\EPP'

Stage 2: not filter_main_defender

filter_main_defender:
    Image|startswith:
        - 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
        - 'C:\Program Files\Windows Defender\'
        - 'C:\Program Files (x86)\Windows Defender\'
    Image|endswith: '\MsMpEng.exe'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
Imagestarts_withC:\Program Files (x86)\Windows Defender\
Imagestarts_withC:\Program Files\Windows Defender\
Imagestarts_withC:\ProgramData\Microsoft\Windows Defender\Platform\
Imageends_with\MsMpEng.exe

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetObjectmatch
  • shellex\ContextMenuHandlers\EPP