Skip to content
Threat Feed

Tag

Registry-Abuse

5 briefs RSS
high advisory

Detection of Windows Defender Service Disabling via Registry Modification

This brief covers the detection of adversaries disabling Windows Defender services by modifying specific registry keys to set the 'Start' value to '0x00000004', indicating an attempt to evade detection and maintain persistence.

Windows Defender +3 defense-evasion persistence windows registry-abuse
2r
high advisory

Windows Defender SmartScreen App Install Control Disabled via Registry Modification

Attackers modify the Windows Registry to disable Windows Defender SmartScreen App Install Control, potentially allowing the installation of malicious web-based applications without restrictions, leading to system compromise and sensitive information exposure.

Splunk Enterprise +3 defense-evasion registry-abuse windows
2r
high advisory

Windows Defender Profile Registry Key Deletion

Detection of Windows Defender profile registry key deletion, indicating potential defense evasion by malware or threat actors aiming to disable security controls.

Windows Defender +3 defense-evasion registry-abuse windows
2r 1t
high advisory

Windows Defender Phishing Filter Override via Registry Modification

The analytic detects modifications to the Windows registry that disable the Windows Defender phishing filter, potentially allowing attackers to deceive users into visiting malicious websites without browser warnings.

Microsoft Edge +3 defense-evasion windows registry-abuse
2r 1t
high advisory

Windows AutoLogger Session Disabled via Registry Modification

An attacker disables Windows AutoLogger sessions by modifying specific registry values to evade defenses and blind EDR and log ingest tools.

Splunk Enterprise +3 defense-evasion windows registry-abuse
2r 1t