Detectionmediumtest
Periodic Backup For System Registry Hives Enabled
Detects the enabling of the "EnablePeriodicBackup" registry value. Once enabled, The OS will backup System registry hives on restarts to the "C:\Windows\System32\config\RegBack" folder. Windows creates a "RegIdleBackup" task to manage subsequent backups. Registry backup was a default behavior on Windows and was disabled as of "Windows 10, version 1803".
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Nasreddine Bencherchali (Nextron Systems)Created Mon Jul 01973ef012-8f1a-4c40-93b4-7e659a5cd17fwindows
Log Source
WindowsRegistry Set
ProductWindows← raw: windows
CategoryRegistry Set← raw: registry_set
Detection Logic
Detection Logic1 selector
detection:
selection:
TargetObject|endswith: '\Control\Session Manager\Configuration Manager\EnablePeriodicBackup'
Details: 'DWORD (0x00000001)'
condition: selectionFalse Positives
Legitimate need for RegBack feature by administrators.
References
MITRE ATT&CK
Tactics
Techniques
Rule Metadata
Rule ID
973ef012-8f1a-4c40-93b4-7e659a5cd17f
Status
test
Level
medium
Type
Detection
Created
Mon Jul 01
Path
rules/windows/registry/registry_set/registry_set_enable_periodic_backup.yml
Raw Tags
attack.collectionattack.t1113