Detection of Windows Defender Security Feature Tampering via Registry

Threat actors and various malware families, including ransomware such as Black Basta and Cactus, as well as info-stealers like RedLine and Azorult, routinely target Windows Defender to facilitate evasive operations. By modifying specific registry keys associated with the Windows Defender 'Real-Time Protection' feature, attackers disable security monitoring capabilities to prevent the detection of subsequent malicious activities. This technique allows adversaries to execute malicious code, maintain persistence, and escalate privileges without being interrupted by endpoint protection software. This activity is a classic example of defense evasion, typically occurring after initial access and often preceding payload delivery or exfiltration. Defenders should prioritize monitoring these specific registry paths, as unauthorized modifications are rarely performed by standard administrative workflows in hardened production environments.

Attack Chain

1. Initial access is established through phishing, exploit, or credential compromise.
2. The attacker executes a primary payload or drops an auxiliary script (e.g., PowerShell, VBScript) with administrative or SYSTEM privileges.
3. The malicious process identifies the presence of active Windows Defender monitoring.
4. The attacker executes registry modification commands (e.g., using reg.exe or PowerShell Set-ItemProperty) to alter 'Real-Time Protection' values to '1'.
5. Windows Defender real-time scanning, script scanning, or behavior monitoring is effectively disabled via these registry updates.
6. The attacker proceeds to deploy ransomware, exfiltration tools, or additional persistent backdoors.
7. The objective is achieved without triggering real-time heuristic or signature-based alerts.

Impact

Successful disabling of Windows Defender real-time protection leaves the endpoint defenseless against further stages of an attack. This activity has been observed in campaigns involving major ransomware groups like Black Basta, Cactus, and Revil, as well as several commodity stealers and RMM tool abuse cases. If this behavior occurs, it indicates an attacker has already obtained high-privilege access and is actively preparing for more destructive or data-intensive actions.

Recommendation

• Deploy the provided Sigma rules to detect registry modifications targeting the 'Real-Time Protection' sub-keys.
• Audit endpoint configuration to ensure Tamper Protection is enabled, which prevents non-authorized processes from modifying these specific registry keys.
• Enable Sysmon Event ID 13 (RegistryEvent) logging to capture detailed modification data, including the process GUID and user performing the change.
• Configure alerts for any registry write operations occurring in HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection.