Detection rules › Splunk
Windows Chrome Auto-Update Disabled via Registry
The following analytic detects modifications to Windows registry values that disable Google Chrome auto-updates. Changes to values such as DisableAutoUpdateChecksCheckboxValue = 1, Update{8A69D345-D564-463C-AFF1-A69D9E530F96} = 0, UpdateDefault = 0, and AutoUpdateCheckPeriodMinutes = 0 can prevent Chrome from receiving security updates. This behavior may indicate attempts to bypass update policies, maintain unauthorized extensions, or facilitate malware persistence. Monitoring these registry changes helps identify potential policy violations or malicious activity targeting browser security.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Collection | T1185 Browser Session Hijacking |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 13 | RegistryEvent (Value Set) |
Stages and Predicates
Stage 1: tstats
tstats WHERE ((Registry.registry_path="*\\Google\\Update*" Registry.registry_value_data=0x00000001 Registry.registry_value_name="DisableAutoUpdateChecksCheckboxValue") OR (Registry.registry_value_data=0x00000000 Registry.registry_value_name IN ("AutoUpdateCheckPeriodMinutes", "UpdateDefault", "Update{8A69D345-D564-463C-AFF1-A69D9E530F96}"))) BY Registry.action, Registry.dest, Registry.process_guid, Registry.process_id, Registry.registry_hive, Registry.registry_path, Registry.registry_key_name, Registry.registry_value_data, Registry.registry_value_name, Registry.registry_value_type, Registry.status, Registry.user, Registry.vendor_product
Stage 2: search
search
Stage 3: search
search
Stage 4: search
search
Stage 5: search
search `macro`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Registry.registry_path | eq |
|
Registry.registry_value_data | eq |
|
Registry.registry_value_name | eq |
|
Registry.registry_value_name | in |
|