Antivirus Filter Driver Disabled on Dev Drive via Registry

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2025•0•13

This rule detects attempts to disable antivirus filter drivers on a "Dev Drive" by setting the 'FltmgrDevDriveAllowAntivirusFilter' registry value to '0x00000000'. This action prevents antivirus mini-filters from inspecting the Dev Drive, potentially allowing malicious activity to go undetected.