Defense Impairment: Removal of Windows Defender context menu
Adversaries may remove the "Scan with Microsoft Defender" context menu handler to hinder manual security scans and reduce the visibility of security products.
Triage facts
Revision 1- Applicability
- Windows
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 11, 07:32 UTC
- Detection
- 1 rule
- Source quality
- A1Likely
Attackers use system utilities, including reg.exe and PowerShell, to delete specific registry keys associated with the Windows Defender shell extension. This action removes the "Scan with Microsoft Defender" option from the Windows right-click context menu for files, directories, and drives. This technique is used to obstruct manual, on-demand scanning by users or administrators.
Impact
Removing the context menu handler limits the ease of manual security scanning, which can delay the detection of malicious files during an active intrusion.
Recommendation
- Deploy detection for registry modifications related to Windows Defender context menu keys.
- Monitor for administrative script execution that invokes removal commands against security-related registry paths.
- Investigate any host where the context menu for Windows Defender has been disabled, as this is highly abnormal in a managed enterprise environment.
Immediate actions
Deploy the provided Sigma rule to detect defense impairment activity.
Threat Hunt
Search for processes (PowerShell, reg.exe) interacting with registry keys containing 'ContextMenuHandlers' and 'EPP'.
Data: Process creation logs with command line arguments, Registry modification events (Sysmon EID 12/13)
Detection coverage 1
Detect Windows Defender Context Menu Handler Removal
highDetects the use of reg.exe or PowerShell to delete the Windows Defender context menu handler registry keys, which removes the Scan option from the context menu.
Detection queries are available on the platform. Get full rules →