Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

Disable Privacy Settings Experience in Registry

Detects registry modifications that disable Privacy Settings Experience

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
François HubautCreated Sun Oct 02Updated Thu Aug 170372e1f9-0fd2-40f7-be1b-a7b2b848fa7bwindows
Log Source
WindowsRegistry Set
ProductWindows← raw: windows
CategoryRegistry Set← raw: registry_set
Detection Logic
Detection Logic1 selector
detection:
    selection:
        TargetObject|endswith: '\SOFTWARE\Policies\Microsoft\Windows\OOBE\DisablePrivacyExperience'
        Details: 'DWORD (0x00000000)'
    condition: selection
False Positives

Legitimate admin script

References
1
Resolving title…
github.com
MITRE ATT&CK
Rule Metadata
Rule ID
0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b
Status
test
Level
medium
Type
Detection
Created
Sun Oct 02
Modified
Thu Aug 17
Author
François Hubaut
Path
rules/windows/registry/registry_set/registry_set_disable_privacy_settings_experience.yml
Raw Tags
attack.defense-evasionattack.t1562.001
View on GitHub