LoFP LoFP / legitimate use of reg.exe to change system settings

Techniques

Sample rules

Registry Tampering Of Internal Tools Settings

Description

Detects registry modifications that tamper with internal Windows tools settings, commonly used by malware to disable security features or system tools

Detection logic

condition: all of selection_*
selection_currentversion_explorer_system_key:
  CommandLine|contains:
  - ConsentPromptBehaviorAdmin
  - DisableChangePassword
  - DisableCMD
  - DisableLockWorkstation
  - DisableNotificationCenter
  - DisableRegistryTools
  - DisableTaskmgr
  - HideSCAHealth
  - HideSCANetwork
  - HideSCAVolume
  - InactivityTimeoutSecs
  - NoClose
  - NoControlPanel
  - NoDesktop
  - NoDispBackgroundPage
  - NoDispCPL
  - NoDrives
  - NoFileMenu
  - NoFind
  - NoLogOff
  - NoPropertiesMyDocuments
  - NoRun
  - NoSetTaskbar
  - NoTrayContextMenu
  - StartMenuLogOff
  - shutdownwithoutlogon
selection_currentversion_explorer_system_root:
  CommandLine|contains:
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
  - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
  - SOFTWARE\Policies\Microsoft\Windows\Explorer
  - SOFTWARE\Policies\Microsoft\Windows\System
selection_reg_cli:
  CommandLine|contains: ' add '
selection_reg_img:
- Image|endswith: \reg.exe
- OriginalFileName: reg.exe