Detectionmediumtest

Add DisallowRun Execution to Registry

Detect set DisallowRun to 1 to prevent user running specific computer program

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

François HubautCreated Fri Aug 19Updated Thu Aug 17275641a5-a492-45e2-a817-7c81e9d9d3e9windows

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection:
        TargetObject|endswith: 'Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun'
        Details: 'DWORD (0x00000001)'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

Resolving title…

github.com

MITRE ATT&CK

Tactics

TA0003 · Persistence TA0005 · Defense Evasion

Techniques

T1112 · Modify Registry

Rule Metadata

Rule ID

275641a5-a492-45e2-a817-7c81e9d9d3e9

Status

test

Level

medium

Type

Detection

Created

Fri Aug 19

Modified

Thu Aug 17

Author

François Hubaut

Path

rules/windows/registry/registry_set/registry_set_disallowrun_execution.yml

Raw Tags

attack.persistenceattack.defense-evasionattack.t1112

View on GitHub