Sophos AV Tamper Protection Registry Key Modification

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects attempts to tamper with Sophos antivirus functionality by modifying specific registry keys related to Tamper Protection. This rule looks for changes to 'SAVEnabled', 'SEDEnabled', or 'Enabled' keys within Sophos Endpoint Defense or SAVService paths, specifically when the value is set to '0x00000000' (disabled).