Disable Internal Tools or Feature in Registry

Severity: medium
Author: frack113, Nasreddine Bencherchali (Nextron Systems), CrimpSec
Source: upstream

Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1112` Modify Registry
Defense Evasion	`T1112` Modify Registry

Event coverage

Provider	Event ID	Title
Sysmon	13	RegistryEvent (Value Set)

Stages and Predicates

Stage 1: `1 of selection_set_1`

or:
TargetObject|endswith: 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisableCMD'
TargetObject|endswith: 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel'
TargetObject|endswith: 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun'
TargetObject|endswith: 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff'
TargetObject|endswith: 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableChangePassword'
TargetObject|endswith: 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation'
TargetObject|endswith: 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools'
TargetObject|endswith: 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskmgr'
TargetObject|endswith: 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage'
TargetObject|endswith: 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL'
TargetObject|endswith: 'SOFTWARE\Policies\Microsoft\Windows\Explorer\DisableNotificationCenter'
TargetObject|endswith: 'SOFTWARE\Policies\Microsoft\Windows\System\DisableCMD'
Details: 'DWORD (0x00000001)'

Stage 2: `1 of selection_set_0`

or:
TargetObject|endswith: 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin'
TargetObject|endswith: 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon'
TargetObject|endswith: 'SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\ToastEnabled'
TargetObject|endswith: 'SYSTEM\CurrentControlSet\Control\StorageDevicePolicies\WriteProtect'
TargetObject|endswith: 'SYSTEM\CurrentControlSet\Control\Storage\Write Protection'
TargetObject|endswith: 'Software\Microsoft\Windows\CurrentVersion\Policies\System\InactivityTimeoutSecs'
Details: 'DWORD (0x00000000)'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Details`	eq	`DWORD (0x00000000)` corpus 38 (sigma 38) `DWORD (0x00000001)` corpus 37 (sigma 37)
`TargetObject`	ends_with	`SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisableCMD` `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel` corpus 2 (sigma 2) `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun` corpus 2 (sigma 2) `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff` `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin` `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableChangePassword` `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation` `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools` `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskmgr` `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage` `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL` `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon` `SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\ToastEnabled` `SOFTWARE\Policies\Microsoft\Windows\Explorer\DisableNotificationCenter` `SOFTWARE\Policies\Microsoft\Windows\System\DisableCMD` `SYSTEM\CurrentControlSet\Control\StorageDevicePolicies\WriteProtect` `SYSTEM\CurrentControlSet\Control\Storage\Write Protection` `Software\Microsoft\Windows\CurrentVersion\Policies\System\InactivityTimeoutSecs`