Security Service Disabled Via Reg.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects the execution of 'reg.exe' to modify registry keys associated with various Windows security services, attempting to disable them. This includes services like Windows Defender components (MsMpSvc, WinDefend, WdBoot, WdFilter, WdNisDrv, WdNisSvc), SecurityHealthService, AppIDSvc, NisSrv, Sense, UsoSvc, wscsvc, and wuauserv, by setting their 'Start' value to '4' (disabled).