legitimate script or group policy (gpo) configuration by administrators

Techniques

t1112

Sample rules

Disable Internal Tools or Feature in Registry

source: sigma
technicques:
- t1112

Description

Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)

Detection logic

condition: 1 of selection_set_*
selection_set_0:
  Details: DWORD (0x00000000)
  TargetObject|endswith:
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\InactivityTimeoutSecs
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon
  - SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\ToastEnabled
  - SYSTEM\CurrentControlSet\Control\Storage\Write Protection
  - SYSTEM\CurrentControlSet\Control\StorageDevicePolicies\WriteProtect
selection_set_1:
  Details: DWORD (0x00000001)
  TargetObject|endswith:
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisableCMD
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCANetwork
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAVolume
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileMenu
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogOff
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyDocuments
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableChangePassword
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskmgr
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL
  - SOFTWARE\Policies\Microsoft\Windows\Explorer\DisableNotificationCenter
  - SOFTWARE\Policies\Microsoft\Windows\System\DisableCMD
selection_set_2:
  Details: DWORD (0x00000002)
  TargetObject|endswith: SOFTWARE\Policies\Microsoft\Windows\System\DisableCMD