Registry Enumeration of Security Products via Uninstall and Defender Keys

Kaung Khant Ko@kaungkhantko

•updated Jul 15, 2026•0•0•1

This rule detects potential security software discovery attempts by monitoring for access to Windows Registry keys associated with installed software (Uninstall keys) and Windows Defender configurations. Adversaries often query these registry locations to identify security products installed on a host to determine if they need to disable them, avoid them, or modify their behavior to evade detection.