Antivirus Filter Driver Disallowed On Dev Drive - Registry

Title: Antivirus Filter Driver Disallowed On Dev Drive - Registry
Status: test
Description:Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".
References:
  -https://twitter.com/0gtweet/status/1720419490519752955
Author: @kostastsale, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-11-05
modified:2024-08-16
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|endswith: '\FilterManager\FltmgrDevDriveAllowAntivirusFilter'
    Details: 'DWORD (0x00000000)'
  condition:selection
Falsepositives:
  -Unlikely
Level: high