Windows Defender Disabled via Registry Modification

Attackers often disable or modify security tools like Windows Defender as a defense evasion tactic. This involves modifying specific registry settings to either completely disable the antivirus or prevent it from starting automatically. The detection rule identifies modifications to the Windows Defender registry settings, such as DisableAntiSpyware and Start values under the WinDefend service key. This tactic is frequently observed post-compromise to facilitate lateral movement, persistence, and data exfiltration without interference from endpoint security solutions. Understanding and detecting these modifications is crucial for maintaining a robust security posture and preventing further malicious activity.

Attack Chain

1. Initial Access: An attacker gains initial access to the system via external means (e.g., compromised credentials, software vulnerability).
2. Privilege Escalation: The attacker escalates privileges to gain administrative rights, required for modifying registry settings.
3. Defense Evasion: The attacker modifies the DisableAntiSpyware registry value under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender to disable Windows Defender.
4. Service Configuration Change: The attacker modifies the Start registry value under HKLM\System\*\ControlSet*\Services\WinDefend to prevent the service from starting automatically (setting it to manual or disabled).
5. Persistence: The attacker establishes persistence to maintain access even after system reboots.
6. Lateral Movement: With defenses impaired, the attacker moves laterally within the network to access additional systems and data.
7. Data Exfiltration: The attacker exfiltrates sensitive data to an external location.
8. Impact: The attacker achieves their objective, whether it's data theft, ransomware deployment, or disruption of services.

Impact

Successful disabling of Windows Defender can lead to complete compromise of the affected system. Without active antivirus protection, malware can execute without detection, leading to data theft, system damage, or ransomware infection. The absence of endpoint protection increases the dwell time of attackers, allowing them to move laterally within the network, potentially impacting numerous systems. This can result in significant financial loss, reputational damage, and regulatory penalties.

Recommendation

• Enable Sysmon registry event logging to detect registry modifications (Data Source: Sysmon).
• Deploy the Sigma rule "Windows Defender Disabled via Registry Modification" to your SIEM and tune for your environment (Sigma rule).
• Investigate any alerts generated by this rule promptly to determine the legitimacy of the registry modification (Sigma rule).
• Monitor process execution chains (parent process tree) for unknown processes modifying the registry (Data Source: Elastic Endgame, Elastic Defend, Sysmon, Microsoft Defender XDR).
• Implement strict access controls to limit who can modify registry settings (all log sources).
• Regularly review and audit Windows Defender configuration to ensure it is enabled and functioning correctly (all log sources).