DFIRHub

Windows registry artifactMicrosoft Security Essentials

Microsoft Security Essentials will automatically take action on all detected threats Status, 0 = Enabled (RoutinelyTakingAction On), 1 = Disabled

  • Threat Hunting
  • 9 keys
  • SOFTWARE

Registry keys

9 keys that RECmd reads for this artifact

  • SOFTWAREDisableRoutinelyTakingAction
    Microsoft\Microsoft Antimalware

    Microsoft Security Essentials will automatically take action on all detected threats Status, 0 = Enabled (RoutinelyTakingAction On), 1 = Disabled

  • SOFTWAREDisableRealtimeMonitoring
    Microsoft\Microsoft Antimalware\Real-Time Protection

    Microsoft Security Essentials Real-Time Monitoring Status, 0 = Enabled (Real-Time Monitoring On), 1 = Disabled

  • SOFTWAREDisableArchiveScanning
    Microsoft\Microsoft Antimalware\Scan

    Microsoft Security Essentials Archive Scanning Status, 0 = Enabled (Archive Scanning On), 1 = Disabled

  • SOFTWAREScheduleDay
    Microsoft\Microsoft Antimalware\Scan

    Microsoft Security Essentials Schedule Day - Specifies the day of the week on which to perform a scheduled scan, 0 = Everyday, 1 = Sunday, 2 = Monday, 3 = Tuesday, 4 = Wednesday, 5 = Thursday, 6 = Friday, 7 = Saturday, 8 = Never

  • SOFTWAREDisableRemovableDriveScanning
    Microsoft\Microsoft Antimalware\Scan

    Microsoft Security Essentials Removable Drive Scanning Status, 0 = Enabled (Removable Drive Scanning On), 1 = Disabled

  • SOFTWAREDisablePrivacyMode
    Microsoft\Microsoft Antimalware\UX Configuration

    Microsoft Security Essentials Privacy Mode Status - Restricts displaying threat history to Administrators only, 0 = Enabled (PrivacyMode On), 1 = Disabled

  • SOFTWARESubmitSamplesConsent
    Microsoft\Microsoft Antimalware\SpyNet

    Microsoft Security Essentials SubmitSamplesConsent Status, 0 = Disabled (SubmitSamplesConsent Off), 1 = Enabled

  • SOFTWARESpynetReporting
    Microsoft\Microsoft Antimalware\SpyNet

    Microsoft Security Essentials SpynetReporting Status - Specifies the type of membership in Microsoft Active Protection Service (MAPS), 0 = Disabled (MAPS Off), 1 = Basic Membership, 2 = Advanced Membership

  • SOFTWARErecursive
    Microsoft\Microsoft Antimalware\Exclusions\

    Microsoft Security Essentials Exclusions

References

1 link

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)