Security tooling disabled via registry policy or service keys

Siemphony@siemphonymediumT1685unverified

AN1369 names three Windows mechanisms — killing AV/EDR processes, stopping their services, and "altering Sysmon registry keys or tampering with exclusion lists" — and asks for them to be correlated inside its `TimeWindow` knob. The correlation is not expressible in lib/sigma, so this rule takes the mechanism that is both single-event and specific: the registry write itself. Four selections cover it. The first is the Defender policy surface, where a single value turns the product off (DisableAntiSpyware, the Real-Time Protection disable values) or blinds it (Spynet reporting and sample submission), plus the exclusion trees, which are the "exclusion lists" the analytic names and which an adversary widens rather than removes. The second is the `Start` value of the services behind the sensors — Defender's WinDefend, WdFilter, WdBoot and WdNisSvc, Defender for Endpoint's Sense, Security Center's wscsvc, Sysmon's driver and service, and the Event Log service itself — since setting one to disabled survives a reboot in a way that killing a process does not. The third is the SysmonDrv parameters key, where the driver's own filtering rules live, and the fourth is the ETW autologger tree, where clearing an autologger stops the telemetry at the source without touching the tool. MITRE's `ServiceNames` knob is what the second selection implements, populated here with the Microsoft and Sysmon service names rather than taken from MITRE; a site running a third-party EDR must add its own service and policy keys, and the same knob is where they go. `ProcessNameExclusions` is not applied — the writing process is in Sysmon's `Image` field, but an allowlist of expected admin tools is site-specific and, on this event, easily satisfied by any adversary who writes the value from a signed binary. Vocabulary, limits and prerequisite. This is written in the Sysmon EventID 13 vocabulary the brief maps `registry_set` onto, where `TargetObject` carries key and value name in one string. Every term below spans that join — the value name is the last segment of each — so any schema that keeps key and value name in separate fields needs them concatenated before a single term can match: Security 4657 splits them across `ObjectName` and `ObjectValueName`, and Defender for Endpoint's `DeviceRegistryEvents` splits them across `RegistryKey` and `RegistryValueName`. On those schemas an unmapped translation of this rule renders cleanly and matches nothing. Sysmon does not emit EventID 13 at all under a bare `sysmon -i` with no configuration — RegistryEvent must be enabled, and the configuration must not filter out the very keys this rule watches, or it returns zero rows that read as quiet when they mean blind. `Details` carries the written data as `DWORD (0x00000004)` on current schemas, so gating the service arm on that string would drop most of the re-enable noise, at the cost of breaking wherever the pipeline formats the value differently. Two arms of the analytic are deliberately not attempted: Sysmon EventID 5 records a process ending but not why, so a rule there would match every reboot and every agent upgrade, and System 7045 service creation is the driver-install path, which belongs with vulnerable-driver abuse and which this brief supplies no driver list for. Where Defender tamper protection is on, writes to the non-policy Defender keys are blocked before they happen, so a blocked attempt leaves nothing here. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0497, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceRegistryEvents| where ((RegistryKey contains "\\Windows Defender\\DisableAntiSpyware" or RegistryKey contains "\\Windows Defender\\DisableAntiVirus" or RegistryKey contains "\\Windows Defender\\DisableRoutinelyTakingAction" or RegistryKey contains "\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring" or RegistryKey contains "\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" or RegistryKey contains "\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" or RegistryKey contains "\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection" or RegistryKey contains "\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" or RegistryKey contains "\\Windows Defender\\Spynet\\SpynetReporting" or RegistryKey contains "\\Windows Defender\\Spynet\\SubmitSamplesConsent" or RegistryKey contains "\\Windows Defender\\Reporting\\DisableEnhancedNotifications" or RegistryKey contains "\\Windows Defender\\Exclusions\\Paths\\" or RegistryKey contains "\\Windows Defender\\Exclusions\\Extensions\\" or RegistryKey contains "\\Windows Defender\\Exclusions\\Processes\\") or (RegistryKey contains "\\Services\\WinDefend\\Start" or RegistryKey contains "\\Services\\WdFilter\\Start" or RegistryKey contains "\\Services\\WdBoot\\Start" or RegistryKey contains "\\Services\\WdNisSvc\\Start" or RegistryKey contains "\\Services\\Sense\\Start" or RegistryKey contains "\\Services\\SecurityHealthService\\Start" or RegistryKey contains "\\Services\\wscsvc\\Start" or RegistryKey contains "\\Services\\SysmonDrv\\Start" or RegistryKey contains "\\Services\\Sysmon\\Start" or RegistryKey contains "\\Services\\Sysmon64\\Start" or RegistryKey contains "\\Services\\EventLog\\Start") or RegistryKey contains "\\Services\\SysmonDrv\\Parameters\\" or (RegistryKey contains "\\Control\\WMI\\Autologger\\EventLog-" or RegistryKey contains "\\Control\\WMI\\Autologger\\DefenderApiLogger" or RegistryKey contains "\\Control\\WMI\\Autologger\\DefenderAuditLogger" or RegistryKey contains "\\Control\\WMI\\Autologger\\SysmonDrv"))

Splunk · SPL

Run this as a search.

index=* ((TargetObject="*\\Windows Defender\\DisableAntiSpyware*" OR TargetObject="*\\Windows Defender\\DisableAntiVirus*" OR TargetObject="*\\Windows Defender\\DisableRoutinelyTakingAction*" OR TargetObject="*\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring*" OR TargetObject="*\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring*" OR TargetObject="*\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection*" OR TargetObject="*\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection*" OR TargetObject="*\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable*" OR TargetObject="*\\Windows Defender\\Spynet\\SpynetReporting*" OR TargetObject="*\\Windows Defender\\Spynet\\SubmitSamplesConsent*" OR TargetObject="*\\Windows Defender\\Reporting\\DisableEnhancedNotifications*" OR TargetObject="*\\Windows Defender\\Exclusions\\Paths\\*" OR TargetObject="*\\Windows Defender\\Exclusions\\Extensions\\*" OR TargetObject="*\\Windows Defender\\Exclusions\\Processes\\*") OR (TargetObject="*\\Services\\WinDefend\\Start*" OR TargetObject="*\\Services\\WdFilter\\Start*" OR TargetObject="*\\Services\\WdBoot\\Start*" OR TargetObject="*\\Services\\WdNisSvc\\Start*" OR TargetObject="*\\Services\\Sense\\Start*" OR TargetObject="*\\Services\\SecurityHealthService\\Start*" OR TargetObject="*\\Services\\wscsvc\\Start*" OR TargetObject="*\\Services\\SysmonDrv\\Start*" OR TargetObject="*\\Services\\Sysmon\\Start*" OR TargetObject="*\\Services\\Sysmon64\\Start*" OR TargetObject="*\\Services\\EventLog\\Start*") OR TargetObject="*\\Services\\SysmonDrv\\Parameters\\*" OR (TargetObject="*\\Control\\WMI\\Autologger\\EventLog-*" OR TargetObject="*\\Control\\WMI\\Autologger\\DefenderApiLogger*" OR TargetObject="*\\Control\\WMI\\Autologger\\DefenderAuditLogger*" OR TargetObject="*\\Control\\WMI\\Autologger\\SysmonDrv*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\disableantispyware*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\disableantivirus*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\disableroutinelytakingaction*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\real-time protection\\\\disablerealtimemonitoring*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\real-time protection\\\\disablebehaviormonitoring*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\real-time protection\\\\disableonaccessprotection*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\real-time protection\\\\disableioavprotection*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\real-time protection\\\\disablescanonrealtimeenable*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\spynet\\\\spynetreporting*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\spynet\\\\submitsamplesconsent*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\reporting\\\\disableenhancednotifications*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\exclusions\\\\paths\\\\*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\exclusions\\\\extensions\\\\*" OR TO_LOWER(registry.path) LIKE "*\\\\windows defender\\\\exclusions\\\\processes\\\\*") OR (TO_LOWER(registry.path) LIKE "*\\\\services\\\\windefend\\\\start*" OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\wdfilter\\\\start*" OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\wdboot\\\\start*" OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\wdnissvc\\\\start*" OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\sense\\\\start*" OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\securityhealthservice\\\\start*" OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\wscsvc\\\\start*" OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\sysmondrv\\\\start*" OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\sysmon\\\\start*" OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\sysmon64\\\\start*" OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\eventlog\\\\start*") OR TO_LOWER(registry.path) LIKE "*\\\\services\\\\sysmondrv\\\\parameters\\\\*" OR (TO_LOWER(registry.path) LIKE "*\\\\control\\\\wmi\\\\autologger\\\\eventlog-*" OR TO_LOWER(registry.path) LIKE "*\\\\control\\\\wmi\\\\autologger\\\\defenderapilogger*" OR TO_LOWER(registry.path) LIKE "*\\\\control\\\\wmi\\\\autologger\\\\defenderauditlogger*" OR TO_LOWER(registry.path) LIKE "*\\\\control\\\\wmi\\\\autologger\\\\sysmondrv*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,registry_set,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)((\\Windows Defender\\DisableAntiSpyware|\\Windows Defender\\DisableAntiVirus|\\Windows Defender\\DisableRoutinelyTakingAction|\\Windows Defender\\Real-Time Protection\\DisableRealtimeMonitoring|\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring|\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection|\\Windows Defender\\Real-Time Protection\\DisableIOAVProtection|\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable|\\Windows Defender\\Spynet\\SpynetReporting|\\Windows Defender\\Spynet\\SubmitSamplesConsent|\\Windows Defender\\Reporting\\DisableEnhancedNotifications|\\Windows Defender\\Exclusions\\Paths\\|\\Windows Defender\\Exclusions\\Extensions\\|\\Windows Defender\\Exclusions\\Processes\\)|(\\Services\\WinDefend\\Start|\\Services\\WdFilter\\Start|\\Services\\WdBoot\\Start|\\Services\\WdNisSvc\\Start|\\Services\\Sense\\Start|\\Services\\SecurityHealthService\\Start|\\Services\\wscsvc\\Start|\\Services\\SysmonDrv\\Start|\\Services\\Sysmon\\Start|\\Services\\Sysmon64\\Start|\\Services\\EventLog\\Start)|\\Services\\SysmonDrv\\Parameters\\|(\\Control\\WMI\\Autologger\\EventLog-|\\Control\\WMI\\Autologger\\DefenderApiLogger|\\Control\\WMI\\Autologger\\DefenderAuditLogger|\\Control\\WMI\\Autologger\\SysmonDrv))</field>    <description>Security tooling disabled via registry policy or service keys</description>    <mitre>      <id>T1685</id>    </mitre>  </rule></group>

At a glance

Logsource: registry_set / windows
Level: medium
Category: defense_evasion_disable_tools
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 67a5241f-2d9f-4066-9325-8e86f2134bf9

ATT&CKT1685

T1685Disable or Modify Tools

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondefense evasion disable tools

defense evasion disable toolsAI draft — unreviewed

01 · What this rule detects

Registry writes that switch off or blind endpoint security tooling. AN1369 names three Windows mechanisms — killing AV/EDR processes, stopping their services, and altering Sysmon registry keys or exclusion lists — and asks for them to be correlated inside its TimeWindow knob. lib/sigma expresses no correlation, so this rule takes the mechanism that is both single-event and specific: the registry write itself. Two arms are deliberately skipped. Sysmon EventID 5 records that a process ended but not why, so a rule there matches every reboot and agent upgrade; System 7045 service creation is the driver-install path, which belongs with vulnerable-driver abuse.

02 · Telemetry you need

registry_set / windows — the Sysmon EventID 13 vocabulary the brief maps this onto, where TargetObject carries key and value name in one concatenated string. Sysmon emits no EventID 13 under a bare sysmon -i: RegistryEvent must be enabled, and the configuration must not filter out the very keys watched here, or the rule returns zero rows that read as quiet when they mean blind. Every term below spans the key/value-name join — the last segment of each is a value name, not a subkey — so any schema keeping the two apart needs them concatenated first. Security 4657 splits them across ObjectName and ObjectValueName; Defender for Endpoint's DeviceRegistryEvents splits them across RegistryKey and RegistryValueName. Read translations.json first: the Sentinel rendering maps TargetObject onto RegistryKey alone, which never contains a value name, so that query parses, looks correct and matches nothing.

03 · How the logic works

Four selections joined by 1 of selection*. selection_defender_policy lists the policy values that turn the product off (DisableAntiSpyware, DisableAntiVirus, the Real-Time Protection Disable* set) or blind it (Spynet reporting, sample submission, enhanced notifications), plus the three exclusion trees — the "exclusion lists" the analytic names, which an adversary widens rather than removes. selection_sensor_service_start matches the Start value under the sensor services: WinDefend, WdFilter, WdBoot, WdNisSvc, Sense, SecurityHealthService, wscsvc, SysmonDrv, Sysmon, Sysmon64 and EventLog itself — setting one to disabled survives a reboot in a way killing a process does not. That selection is MITRE's ServiceNames knob, populated here with Microsoft and Sysmon service names chosen by the pipeline, not supplied by MITRE; a third-party EDR's service and policy keys belong in the same place. selection_sysmon_driver_config watches SysmonDrv\Parameters\, where the driver's filtering rules live. selection_etw_autologger covers the autologger tree — note precisely what it catches: setting an autologger's Start or EnableProperty value to zero. EventID 13 is value-set only, so deleting an autologger key or SysmonDrv\Parameters\Rules emits EventID 14 (registry_rename) and needs a companion rule Sigma cannot OR into this one. MITRE's ProcessNameExclusions is not applied: an allowlist of admin tools is site-specific and, on this event, satisfied by writing from a signed binary.

04 · Common false positives

Intune/MDM baseline refresh rewrites registry policy on a cycle, as does the Group Policy Registry CSE where "process even if the GPOs have not changed" is enabled — the loudest arm by far. Registering a third-party antivirus disables Defender by design. Service desks and installers add documented scan exclusions. A Sysmon version bump rewrites its own service, Parameters and autologger keys, so the sensor trips its own rule. Where tamper protection is on, writes to the non-policy Defender keys are blocked and leave nothing here at all.

05 · Detection maturity

tier_1: Lowest tier. Machine-derived from MITRE ATT&CK v19.2 and never executed against a log line — no true positive, no false positive, no measured volume, and everything above about relative noise is argument rather than evidence. It moves up only after you confirm your Sysmon config emits these keys, fix the Sentinel field map, and run the rule over history.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

The medium level is honest for the policy and exclusion arms and far too quiet for the rest: on a managed estate \Services\EventLog\Start, the SysmonDrv arms and the autologger arm should be near-silent, so split them into a second rule at high or at minimum route them separately. Suppress baseline writes by the writing Image together with the value, never by key alone. Gating the service arm on Details containing DWORD (0x00000004) drops most re-enable noise, at the cost of breaking wherever your pipeline formats values differently.

Declared by the author

Group Policy and Intune reapplying a Defender baseline. Registry policy is rewritten on each refresh cycle whether or not the content changed, so any tenant whose baseline sets exclusions, turns off sample submission or disables enhanced notifications produces these writes on every managed host every couple of hours. This is the loudest source here by a wide margin and is why the rule is medium rather than high.
Installing a third-party antivirus product. Registering a non-Microsoft AV disables Defender's real-time protection by design, writing DisableAntiSpyware or the Real-Time Protection values and setting WinDefend's Start value to disabled, so an AV rollout matches on every endpoint it reaches.
Adding legitimate scan exclusions. Database, backup, virtualisation and line-of-business installers document exclusion paths for their data directories, and the service desk adds them by hand when scanning interferes with a product; each write lands in the Exclusions tree in exactly the shape an adversary's would.
Upgrading or reinstalling the monitoring agent itself. A Sysmon version bump or configuration reinstall rewrites the SysmonDrv service, Start and Parameters keys and its autologger entry, so every maintenance push of the sensor trips its own rule.

Noise checkfires on 1 of 6

Fires on 1 of 6 ordinary behaviours the baseline holds for this log type. Each is something a managed estate does on purpose, so each is a false positive an analyst would have to close.

reg-defender-exclusion-policy
A managed antivirus exclusion for a line-of-business database directory, written by Group Policy.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
0 true · 1 false · 100.0% noise

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1685, evaluated against their registry_set events.

Share this rule

/u/siemphony/67a5241f-2d9f-4066-9325-8e86f2134bf9

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Security tooling disabled via registry policy or service keys

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it