Registry Tampering Of Internal Tools Settings

 1title: Registry Tampering Of Internal Tools Settings
 2id: ccc946a3-f65a-432a-bb6f-efc6acc1fd27
 3related:
 4    - id: e2482f8d-3443-4237-b906-cc145d87a076
 5      type: similar
 6status: experimental
 7description: Detects registry modifications that tamper with internal Windows tools settings, commonly used by malware to disable security features or system tools
 8references:
 9    - https://bazaar.abuse.ch/sample/7bde840c7e8c36dce4c3bac937bcf39f36a6f118001b406bfbbc25451ce44fb4/
10    - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
11    - https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions
12    - https://www.sentinelone.com/blog/cybervolk-returns-flawed-volklocker-brings-new-features-with-growing-pains/
13author: Swachchhanda Shrawan Poudel (Nextron Systems)
14date: 2026-10-18
15tags:
16    - attack.persistence
17    - attack.defense-impairment
18    - attack.t1112
19logsource:
20    category: process_creation
21    product: windows
22detection:
23    selection_reg_img:
24        - Image|endswith: '\reg.exe'
25        - OriginalFileName: 'reg.exe'
26    selection_reg_cli:
27        CommandLine|contains: ' add '
28    selection_currentversion_explorer_system_root:
29        CommandLine|contains:
30            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer'
31            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
32            - 'SOFTWARE\Policies\Microsoft\Windows\Explorer'
33            - 'SOFTWARE\Policies\Microsoft\Windows\System'
34    selection_currentversion_explorer_system_key:
35        CommandLine|contains:
36            - 'ConsentPromptBehaviorAdmin'
37            - 'DisableChangePassword'
38            - 'DisableCMD'
39            - 'DisableLockWorkstation'
40            - 'DisableNotificationCenter'
41            - 'DisableRegistryTools'
42            - 'DisableTaskmgr'
43            - 'HideSCAHealth'
44            - 'HideSCANetwork'
45            - 'HideSCAVolume'
46            - 'InactivityTimeoutSecs'
47            - 'NoClose'
48            - 'NoControlPanel'
49            - 'NoDesktop'
50            - 'NoDispBackgroundPage'
51            - 'NoDispCPL'
52            - 'NoDrives'
53            - 'NoFileMenu'
54            - 'NoFind'
55            - 'NoLogOff'
56            - 'NoPropertiesMyDocuments'
57            - 'NoRun'
58            - 'NoSetTaskbar'
59            - 'NoTrayContextMenu'
60            - 'StartMenuLogOff'
61            - 'shutdownwithoutlogon'
62    condition: all of selection_*
63falsepositives:
64    - Legitimate use of reg.exe to change system settings
65level: medium
66simulation:
67    - type: atomic-red-team
68      name: Modify Registry of Current User Profile - cmd
69      technique: T1112
70      atomic_guid: 1324796b-d0f6-455a-b4ae-21ffee6aa6b9
71regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_internal_tools_setting_tampering/info.yml