Elastic Defend high stable eql

Suspicious Antivirus Registration

Identifies attempts to disable Windows Defender via registering a rogue anti-virus.

View Source

Detection Logic

registry where event.action == "modification" and process.executable : "C:\\Windows\\System32\\svchost.exe" and
 registry.value : "REPORTINGEXE" and registry.path : "HKLM\\SOFTWARE\\Microsoft\\Security Center\\Provider\\Av\\{*}\\REPORTINGEXE" and
 registry.data.strings : "C:\\Windows\\System32\\*.exe"

Field Validations

Loading…

Comments (0)

Loading comments...