Provider Registration Controls
WSC-API v2
Simulation Presets
Active Provider Security Center Telemetry
SIGNATURE REJECTED
Registered Provider Name
PhantomGuard AV
Provider Instance GUID
{F2B83120-4E9A-4B7C-9182-3A2B1C9D8E7F}
Registration Method
User-Mode API Injection
Authenticode Trust Verification
FAIL: Self-Signed / Untrusted Root
WSC Product State Hex Mask
0x00041000 (RTP Enabled, Defs Current)
Defender Engine Fallback
Disabled (Suppress Antivirus Conflict)
DFIR Windows Security Center Telemetry Log
Event Log & API Monitor
Detection Engineering & DFIR Rules
title: Suspicious WSC Antivirus Provider Registration
id: wsc-fake-av-passive-mode
status: production
description: Detects unauthorized registration of third-party security products in Windows Security Center designed to disable Defender RTP.
logsource:
product: windows
service: security-center
detection:
selection_provider:
EventID: 1151
filter_known_vendors:
ProviderGuid|contains:
- '{CrowdStrike-ELAM-Prod}'
- '{SentinelOne-TrueRTP}'
condition: selection_provider and not filter_known_vendors
falsepositives:
- Legitimate custom internal antivirus enterprise deployments
level: high
Microsoft-Windows-Security-Center / Operational
Event ID: 1151
Level: Warning
Description: Windows Security Center registered an antivirus provider.
Payload:
ProviderName: PhantomGuard AV
ProviderGuid: {F2B83120-4E9A-4B7C-9182-3A2B1C9D8E7F}
ProductState: 0x41000
SignatureStatus: Invalid / Unverified
CallerProcess: C:\Windows\System32\rundll32.exe (PID: 4892)
# PowerShell Forensic WSC Audit Script
Get-CimInstance -Namespace "root\SecurityCenter2" -ClassName "AntiVirusProduct" |
Select-Object displayName, instanceGuid, pathToSignedProductExe, productState |
ForEach-Object {
$sig = Get-AuthenticodeSignature -FilePath $_.pathToSignedProductExe -ErrorAction SilentlyContinue
[PSCustomObject]@{
Name = $_.displayName
GUID = $_.instanceGuid
Path = $_.pathToSignedProductExe
Signed = $sig.Status -eq 'Valid'
StateHex = ("0x{0:X}" -f $_.productState)
}
}
Defense Hardening Checklist
AUDIT
Monitor SecurityCenter2 Namespace Changes
Alert on WMI `__InstanceCreationEvent` in `root\SecurityCenter2`.
ENFORCE
Early Launch Anti-Malware (ELAM) Signing
Ensure only Microsoft WHQL signed drivers register as AV.
HARDEN
Force Defender Periodic Scanning (AllowPassiveScan)
Maintain background cloud heuristics even in secondary mode.
INGEST
Forward Windows Event ID 1151 to SIEM
Baseline known enterprise AV GUIDs to flag outliers immediately.