Disable Privacy Settings Experience in Registry
Detects registry modifications that disable Privacy Settings Experience
Sigma rule (View on GitHub)
1title: Disable Privacy Settings Experience in Registry
2id: 0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b
3status: experimental
4description: Detects registry modifications that disable Privacy Settings Experience
5references:
6 - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1562.001/T1562.001.md
7author: frack113
8date: 2022/10/02
9modified: 2023/08/17
10tags:
11 - attack.defense_evasion
12 - attack.t1562.001
13logsource:
14 category: registry_set
15 product: windows
16detection:
17 selection:
18 TargetObject|endswith: '\SOFTWARE\Policies\Microsoft\Windows\OOBE\DisablePrivacyExperience'
19 Details: 'DWORD (0x00000000)'
20 condition: selection
21falsepositives:
22 - Legitimate admin script
23level: medium
References
Related rules
- Disable Exploit Guard Network Protection on Windows Defender
- Disable PUA Protection on Windows Defender
- Disable Tamper Protection on Windows Defender
- Disable Windows Defender Functionalities Via Registry Keys
- Disabled Windows Defender Eventlog