Skip to content

Siemphony is in beta and still being built. How a rule earns its badge.

Siemphonybeta
Siemphony’s repertoire

Security tooling disabled via registry policy or service keys

Siemphony@siemphonymediumT1685unverifiedPlaybook · Defence evasion
AN1369 names three Windows mechanisms — killing AV/EDR processes, stopping their services, and "altering Sysmon registry keys or tampering with exclusion lists" — and asks for them to be correlated inside its `TimeWindow` knob. The correlation is not expressible in lib/sigma, so this rule takes the mechanism that is both single-event and specific: the registry write itself. Four selections cover it. The first is the Defender policy surface, where a single value turns the product off (DisableAntiSpyware, the Real-Time Protection disable values) or blinds it (Spynet reporting and sample submission), plus the exclusion trees, which are the "exclusion lists" the analytic names and which an adversary widens rather than removes. The second is the `Start` value of the services behind the sensors — Defender's WinDefend, WdFilter, WdBoot and WdNisSvc, Defender for Endpoint's Sense, Security Center's wscsvc, Sysmon's driver and service, and the Event Log service itself — since setting one to disabled survives a reboot in a way that killing a process does not. The third is the SysmonDrv parameters key, where the driver's own filtering rules live, and the fourth is the ETW autologger tree, where clearing an autologger stops the telemetry at the source without touching the tool. MITRE's `ServiceNames` knob is what the second selection implements, populated here with the Microsoft and Sysmon service names rather than taken from MITRE; a site running a third-party EDR must add its own service and policy keys, and the same knob is where they go. `ProcessNameExclusions` is not applied — the writing process is in Sysmon's `Image` field, but an allowlist of expected admin tools is site-specific and, on this event, easily satisfied by any adversary who writes the value from a signed binary. Vocabulary, limits and prerequisite. This is written in the Sysmon EventID 13 vocabulary the brief maps `registry_set` onto, where `TargetObject` carries key and value name in one string. Every term below spans that join — the value name is the last segment of each — so any schema that keeps key and value name in separate fields needs them concatenated before a single term can match: Security 4657 splits them across `ObjectName` and `ObjectValueName`, and Defender for Endpoint's `DeviceRegistryEvents` splits them across `RegistryKey` and `RegistryValueName`. On those schemas an unmapped translation of this rule renders cleanly and matches nothing. Sysmon does not emit EventID 13 at all under a bare `sysmon -i` with no configuration — RegistryEvent must be enabled, and the configuration must not filter out the very keys this rule watches, or it returns zero rows that read as quiet when they mean blind. `Details` carries the written data as `DWORD (0x00000004)` on current schemas, so gating the service arm on that string would drop most of the re-enable noise, at the cost of breaking wherever the pipeline formats the value differently. Two arms of the analytic are deliberately not attempted: Sysmon EventID 5 records a process ending but not why, so a rule there would match every reboot and every agent upgrade, and System 7045 service creation is the driver-install path, which belongs with vulnerable-driver abuse and which this brief supplies no driver list for. Where Defender tamper protection is on, writes to the non-policy Defender keys are blocked before they happen, so a blocked attempt leaves nothing here. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0497, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The detection

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

title: Security tooling disabled via registry policy or service keysid: 67a5241f-2d9f-4066-9325-8e86f2134bf9status: experimentaldescription: |  AN1369 names three Windows mechanisms — killing AV/EDR processes, stopping  their services, and "altering Sysmon registry keys or tampering with exclusion  lists" — and asks for them to be correlated inside its `TimeWindow` knob. The  correlation is not expressible in lib/sigma, so this rule takes the mechanism  that is both single-event and specific: the registry write itself. Four  selections cover it. The first is the Defender policy surface, where a single  value turns the product off (DisableAntiSpyware, the Real-Time Protection  disable values) or blinds it (Spynet reporting and sample submission), plus the  exclusion trees, which are the "exclusion lists" the analytic names and which  an adversary widens rather than removes. The second is the `Start` value of the  services behind the sensors — Defender's WinDefend, WdFilter, WdBoot and  WdNisSvc, Defender for Endpoint's Sense, Security Center's wscsvc, Sysmon's  driver and service, and the Event Log service itself — since setting one to  disabled survives a reboot in a way that killing a process does not. The third  is the SysmonDrv parameters key, where the driver's own filtering rules live,  and the fourth is the ETW autologger tree, where clearing an autologger stops  the telemetry at the source without touching the tool. MITRE's `ServiceNames`  knob is what the second selection implements, populated here with the Microsoft  and Sysmon service names rather than taken from MITRE; a site running a  third-party EDR must add its own service and policy keys, and the same knob is  where they go. `ProcessNameExclusions` is not applied — the writing process is  in Sysmon's `Image` field, but an allowlist of expected admin tools is  site-specific and, on this event, easily satisfied by any adversary who writes  the value from a signed binary.  Vocabulary, limits and prerequisite. This is written in the Sysmon EventID 13  vocabulary the brief maps `registry_set` onto, where `TargetObject` carries key  and value name in one string. Every term below spans that join — the value name  is the last segment of each — so any schema that keeps key and value name in  separate fields needs them concatenated before a single term can match:  Security 4657 splits them across `ObjectName` and `ObjectValueName`, and  Defender for Endpoint's `DeviceRegistryEvents` splits them across `RegistryKey`  and `RegistryValueName`. On those schemas an unmapped translation of this rule  renders cleanly and matches nothing. Sysmon does not emit EventID 13 at all under a bare  `sysmon -i` with no configuration — RegistryEvent must be enabled, and the  configuration must not filter out the very keys this rule watches, or it  returns zero rows that read as quiet when they mean blind. `Details` carries  the written data as `DWORD (0x00000004)` on current schemas, so gating the  service arm on that string would drop most of the re-enable noise, at the cost  of breaking wherever the pipeline formats the value differently. Two arms of  the analytic are deliberately not attempted: Sysmon EventID 5 records a  process ending but not why, so a rule there would match every reboot and every  agent upgrade, and System 7045 service creation is the driver-install path,  which belongs with vulnerable-driver abuse and which this brief supplies no  driver list for. Where Defender tamper protection is on, writes to the  non-policy Defender keys are blocked before they happen, so a blocked attempt  leaves nothing here.  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0497, not hand-written and not tested by its author. Any lab result is on this rule's own page.references:  - https://attack.mitre.org/techniques/T1685  - https://attack.mitre.org/detectionstrategies/DET0497author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)date: 2026-08-17tags:  - attack.defense-evasion  - attack.t1685logsource:  category: registry_set  product: windowsdetection:  selection_defender_policy:    TargetObject|contains:      - '\Windows Defender\DisableAntiSpyware'      - '\Windows Defender\DisableAntiVirus'      - '\Windows Defender\DisableRoutinelyTakingAction'      - '\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring'      - '\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring'      - '\Windows Defender\Real-Time Protection\DisableOnAccessProtection'      - '\Windows Defender\Real-Time Protection\DisableIOAVProtection'      - '\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable'      - '\Windows Defender\Spynet\SpynetReporting'      - '\Windows Defender\Spynet\SubmitSamplesConsent'      - '\Windows Defender\Reporting\DisableEnhancedNotifications'      - '\Windows Defender\Exclusions\Paths\'      - '\Windows Defender\Exclusions\Extensions\'      - '\Windows Defender\Exclusions\Processes\'  selection_sensor_service_start:    TargetObject|contains:      - '\Services\WinDefend\Start'      - '\Services\WdFilter\Start'      - '\Services\WdBoot\Start'      - '\Services\WdNisSvc\Start'      - '\Services\Sense\Start'      - '\Services\SecurityHealthService\Start'      - '\Services\wscsvc\Start'      - '\Services\SysmonDrv\Start'      - '\Services\Sysmon\Start'      - '\Services\Sysmon64\Start'      - '\Services\EventLog\Start'  selection_sysmon_driver_config:    TargetObject|contains: '\Services\SysmonDrv\Parameters\'  selection_etw_autologger:    TargetObject|contains:      - '\Control\WMI\Autologger\EventLog-'      - '\Control\WMI\Autologger\DefenderApiLogger'      - '\Control\WMI\Autologger\DefenderAuditLogger'      - '\Control\WMI\Autologger\SysmonDrv'  condition: 1 of selection*falsepositives:  - "Group Policy and Intune reapplying a Defender baseline. Registry policy is rewritten on each refresh cycle whether or not the content changed, so any tenant whose baseline sets exclusions, turns off sample submission or disables enhanced notifications produces these writes on every managed host every couple of hours. This is the loudest source here by a wide margin and is why the rule is medium rather than high."  - "Installing a third-party antivirus product. Registering a non-Microsoft AV disables Defender's real-time protection by design, writing DisableAntiSpyware or the Real-Time Protection values and setting WinDefend's Start value to disabled, so an AV rollout matches on every endpoint it reaches."  - "Adding legitimate scan exclusions. Database, backup, virtualisation and line-of-business installers document exclusion paths for their data directories, and the service desk adds them by hand when scanning interferes with a product; each write lands in the Exclusions tree in exactly the shape an adversary's would."  - "Upgrading or reinstalling the monitoring agent itself. A Sysmon version bump or configuration reinstall rewrites the SysmonDrv service, Start and Parameters keys and its autologger entry, so every maintenance push of the sensor trips its own rule."level: medium

Sentinel · KQL

Run this as a search.

DeviceRegistryEvents| where ((RegistryKey contains "\\Windows Defender\\DisableAntiSpyware" or RegistryKey contains "\\Windows Defender\\DisableAntiVirus" or RegistryKey contains "\\Windows Defender\\DisableRoutinelyTakingAction" or RegistryKey contains "\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" or RegistryKey contains "\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" or RegistryKey contains "\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" or RegistryKey contains "\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection" or RegistryKey contains "\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" or RegistryKey contains "\\Windows Defender\\Spynet\\SpynetReporting" or RegistryKey contains "\\Windows Defender\\Spynet\\SubmitSamplesConsent" or RegistryKey contains "\\Windows Defender\\Reporting\\DisableEnhancedNotifications" or RegistryKey contains "\\Windows Defender\\Exclusions\\Paths\\" or RegistryKey contains "\\Windows Defender\\Exclusions\\Extensions\\" or RegistryKey contains "\\Windows Defender\\Exclusions\\Processes\\") or (RegistryKey contains "\\Services\\WinDefend\\Start" or RegistryKey contains "\\Services\\WdFilter\\Start" or RegistryKey contains "\\Services\\WdBoot\\Start" or RegistryKey contains "\\Services\\WdNisSvc\\Start" or RegistryKey contains "\\Services\\Sense\\Start" or RegistryKey contains "\\Services\\SecurityHealthService\\Start" or RegistryKey contains "\\Services\\wscsvc\\Start" or RegistryKey contains "\\Services\\SysmonDrv\\Start" or RegistryKey contains "\\Services\\Sysmon\\Start" or RegistryKey contains "\\Services\\Sysmon64\\Start" or RegistryKey contains "\\Services\\EventLog\\Start") or RegistryKey contains "\\Services\\SysmonDrv\\Parameters\\" or (RegistryKey contains "\\Control\\WMI\\Autologger\\EventLog-" or RegistryKey contains "\\Control\\WMI\\Autologger\\DefenderApiLogger" or RegistryKey contains "\\Control\\WMI\\Autologger\\DefenderAuditLogger" or RegistryKey contains "\\Control\\WMI\\Autologger\\SysmonDrv"))

Splunk · SPL

Run this as a search.

index=* ((TargetObject="*\\Windows Defender\\DisableAntiSpyware*" OR TargetObject="*\\Windows Defender\\DisableAntiVirus*" OR TargetObject="*\\Windows Defender\\DisableRoutinelyTakingAction*" OR TargetObject="*\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring*" OR TargetObject="*\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring*" OR TargetObject="*\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection*" OR TargetObject="*\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection*" OR TargetObject="*\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable*" OR TargetObject="*\\Windows Defender\\Spynet\\SpynetReporting*" OR TargetObject="*\\Windows Defender\\Spynet\\SubmitSamplesConsent*" OR TargetObject="*\\Windows Defender\\Reporting\\DisableEnhancedNotifications*" OR TargetObject="*\\Windows Defender\\Exclusions\\Paths\\*" OR TargetObject="*\\Windows Defender\\Exclusions\\Extensions\\*" OR TargetObject="*\\Windows Defender\\Exclusions\\Processes\\*") OR (TargetObject="*\\Services\\WinDefend\\Start*" OR TargetObject="*\\Services\\WdFilter\\Start*" OR TargetObject="*\\Services\\WdBoot\\Start*" OR TargetObject="*\\Services\\WdNisSvc\\Start*" OR TargetObject="*\\Services\\Sense\\Start*" OR TargetObject="*\\Services\\SecurityHealthService\\Start*" OR TargetObject="*\\Services\\wscsvc\\Start*" OR TargetObject="*\\Services\\SysmonDrv\\Start*" OR TargetObject="*\\Services\\Sysmon\\Start*" OR TargetObject="*\\Services\\Sysmon64\\Start*" OR TargetObject="*\\Services\\EventLog\\Start*") OR TargetObject="*\\Services\\SysmonDrv\\Parameters\\*" OR (TargetObject="*\\Control\\WMI\\Autologger\\EventLog-*" OR TargetObject="*\\Control\\WMI\\Autologger\\DefenderApiLogger*" OR TargetObject="*\\Control\\WMI\\Autologger\\DefenderAuditLogger*" OR TargetObject="*\\Control\\WMI\\Autologger\\SysmonDrv*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\disableantispyware*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\disableantivirus*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\disableroutinelytakingaction*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\real-time protection\\\\disablerealtimemonitoring*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\real-time protection\\\\disablebehaviormonitoring*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\real-time protection\\\\disableonaccessprotection*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\real-time protection\\\\disableioavprotection*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\real-time protection\\\\disablescanonrealtimeenable*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\spynet\\\\spynetreporting*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\spynet\\\\submitsamplesconsent*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\reporting\\\\disableenhancednotifications*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\exclusions\\\\paths\\\\*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\exclusions\\\\extensions\\\\*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\exclusions\\\\processes\\\\*") OR (TO_LOWER(registry.path) LIKE "*\\\\services\\\\windefend\\\\start*" OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\wdfilter\\\\start*" OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\wdboot\\\\start*" OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\wdnissvc\\\\start*" OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\sense\\\\start*" OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\securityhealthservice\\\\start*" OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\wscsvc\\\\start*" OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\sysmondrv\\\\start*" OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\sysmon\\\\start*" OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\sysmon64\\\\start*" OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\eventlog\\\\start*") OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\sysmondrv\\\\parameters\\\\*" OR (TO_LOWER(registry.path) LIKE "*\\\\control\\\\wmi\\\\autologger\\\\eventlog-*" OR TO_LOWER(registry.path) LIKE "*\\\\control\\\\wmi\\\\autologger\\\\defenderapilogger*" OR TO_LOWER(registry.path) LIKE "*\\\\control\\\\wmi\\\\autologger\\\\defenderauditlogger*" OR TO_LOWER(registry.path) LIKE "*\\\\control\\\\wmi\\\\autologger\\\\sysmondrv*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,registry_set,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)((\\Windows Defender\\DisableAntiSpyware|\\Windows Defender\\DisableAntiVirus|\\Windows Defender\\DisableRoutinelyTakingAction|\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring|\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring|\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection|\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection|\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable|\\Windows Defender\\Spynet\\SpynetReporting|\\Windows Defender\\Spynet\\SubmitSamplesConsent|\\Windows Defender\\Reporting\\DisableEnhancedNotifications|\\Windows Defender\\Exclusions\\Paths\\|\\Windows Defender\\Exclusions\\Extensions\\|\\Windows Defender\\Exclusions\\Processes\\)|(\\Services\\WinDefend\\Start|\\Services\\WdFilter\\Start|\\Services\\WdBoot\\Start|\\Services\\WdNisSvc\\Start|\\Services\\Sense\\Start|\\Services\\SecurityHealthService\\Start|\\Services\\wscsvc\\Start|\\Services\\SysmonDrv\\Start|\\Services\\Sysmon\\Start|\\Services\\Sysmon64\\Start|\\Services\\EventLog\\Start)|\\Services\\SysmonDrv\\Parameters\\|(\\Control\\WMI\\Autologger\\EventLog-|\\Control\\WMI\\Autologger\\DefenderApiLogger|\\Control\\WMI\\Autologger\\DefenderAuditLogger|\\Control\\WMI\\Autologger\\SysmonDrv))</field>    <description>Security tooling disabled via registry policy or service keys</description>    <mitre>      <id>T1685</id>    </mitre>  </rule></group>

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Log in to react
Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

Log in to report a verdict.

Log in to join the discussion.

No comments yet. Someone who deploys this will have something to say about it.