Anvilogic high experimental other

Defender Registry Values Modified [snowflake-crowdstrikefdr_process]

Adversaries may interact with the Windows Registry to disable security tools to avoid possible detection of their malware/tools and activities. They may interact directly with the registry via command line interpreters or they may abuse system utilities to achieve the same goals, such as SystemSettingsAdminFlows.exe. This use case detects commands for registry modifications targeting Windows Defender capabilities.

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform ilike '%Win%' and (regexp_like(process_path, '.*(cmd
| pwsh
| powershell)\\\.exe.*', 'i') or regexp_like(parent_process_name, '.*(cmd
| pwsh
| powershell)\\\.exe.*', 'i')) and (regexp_like(process, '.*((DisableEnhancedNotifications
| RPT.+1)
| (SubmitSamplesConsent
| SpynetReporting).+0).*', 'i') or regexp_like(process, '.*(Set-ItemProperty
| sp\\\s
| ADD\\\s).+SOFTWARE\\\x5cMicrosoft\\\x5cWindows\\\s+Defender\\\x5c(Reporting
| Spynet
| Real-Time\\\s+Protection).*', 'i'))

Field Validations

Loading…

Comments (0)

Loading comments...