Detection of Malicious Security Center AV Registry Tampering

Adversaries often attempt to impair security defenses by manipulating the Windows Security Center (WSC) to mask their presence or facilitate the deployment of malicious tools. By modifying registry keys located under 'HKLM\SOFTWARE\Microsoft\Security Center\Provider\Av', attackers can register fake or misleading antivirus product information, such as the 'DisplayName', 'ProductEXE', or 'ReportingExe' values. This technique, often referred to as "Defendnot," aims to trick the operating system and monitoring tools into believing a legitimate security product is active, effectively bypassing security software detection or silencing alerts. This behavior is typically observed in the context of post-exploitation toolkits seeking to maintain persistence and evade endpoint detection and response (EDR) agents.

Impact

Successful manipulation of Security Center registry keys can lead to the successful deployment of secondary payloads, prolonged dwell time, and the potential for complete system compromise due to the blinding of security telemetry and defensive controls.

Recommendation

• Deploy the provided Sigma rule to your SIEM to monitor for unauthorized writes to WSC registry keys.
• Baseline the 'Details' field in your environment to identify legitimate antivirus installers that may not be included in the default filter list.
• Investigate any process other than 'svchost.exe' attempting to modify these specific registry keys.