[BUG] Windows DisableAntiSpyware Registry" overlaps with and is weaker than "Disable Defender AntiVirus Registry
Maintainers usually reply within 1 day
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 45/100
- Issue type
- Refactor
- Clarity
- Mostly clear
- Activity status
- Active
- Domain
- security
Research direction
Compare the two Defender-registry detections named in the table: Disable Defender AntiVirus Registry and Windows DisableAntiSpyware Registry, focusing on value names, value data and the path filter. Before editing, confirm with maintainers whether the non-policy Windows Defender key should be covered, since the issue leaves that open. Done means one detection is kept with the agreed coverage, the other is deprecated, and the repository's detection validation still passes.
Written by the indexing model from the issue text.
Description
Summary
Both detections alert on Defender being disabled via registry. Disable Defender AntiVirus Registry covers everything the other does under the Defender policy path, with better logic. Running both produces duplicate alerts for the same event and two filter macros to tune.
Comparison
| Disable Defender AntiVirus Registry | Windows DisableAntiSpyware Registry | |
|---|---|---|
| Value names | DisableAntiSpyware, DisableAntiVirus |
DisableAntiSpyware only |
| Value data | IN (1, 0x00000001) |
= "0x00000001" only |
| Path filter | *\Policies\Microsoft\Windows Defender* |
none |
Caveat
The second has no path filter, so it also matches DisableAntiSpyware outside the policy key (e.g. HKLM\SOFTWARE\Microsoft\Windows Defender). If that coverage is wanted, it should be added to the first detection.
Proposal
Deprecate Windows DisableAntiSpyware Registry, optionally extending the first detection's path filter to cover the non-policy key. Happy to open a PR.
- Dominant language
- Python
- Stars
- 1.7k
- Forks
- 507
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 35
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from splunk/security_content
-
bug
Difficulty 1/5 Under an hour Newbie friendliness 78/100
splunk/security_content#4418 ·
Maintainers usually reply within 1 day
-
[BUG] Windows New EventLog ChannelAccess Registry Value Set: second path has single backslashesOpenbug
Difficulty 1/5 1-3 hours Newbie friendliness 78/100
splunk/security_content#4417 ·
Maintainers usually reply within 1 day
-
[BUG]Linux Change File Owner To Root: detection bypass using "chown root: <file>"Possibly taken @thegreatmhn claimed this 1 day ago. Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
splunk/security_content#4413 · 4 comments ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
splunk/security_content#4401 ·
Maintainers usually reply within 1 day
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
splunk/security_content#4400 ·
Maintainers usually reply within 1 day
All issues in splunk/security_content
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
deepchem/deepchem#5289 · 1 comment ·
Maintainers usually reply within 2 days
-
Difficulty 1/5 Under an hour Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 60/100
UKGovernmentBEIS/inspect_evals#2892 · 1 comment ·
Maintainers usually reply within 1 day
-
Versioning docs: say that no output from the 0.46 warning check means nothing is affectedPossibly taken @grelinfo claimed this today. Opendocumentation priority:low size:S
Difficulty 1/5 Under an hour Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100
alphacrack/readme2demo#293 ·