eScan Antivirus Exception Abuse via MwMonitor Registry Modification
Detects modification of the eScan for Windows MwMonitor registry key to add critical system directories (C:\Windows, C:\Program Files, C:\Program Files (x86)) to antivirus exceptions. This behavior significantly weakens endpoint protection and may indicate malicious tampering or supply-chain abuse.
Sigma
