Sigma rule: Registry Tampering Of Internal Tools Settings

Rule

Title

Registry Tampering Of Internal Tools Settings

Status

experimental

Level

medium

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-10-18

File

rules/windows/process_creation/proc_creation_win_reg_internal_tools_setting_tampering.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects registry modifications that tamper with internal Windows tools settings, commonly used by malware to disable security features or system tools

Log source

product

windows

category

process_creation

Detection

selection_reg_img:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'
selection_reg_cli:
    CommandLine|contains: ' add '
selection_currentversion_explorer_system_root:
    CommandLine|contains:
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
        - 'SOFTWARE\Policies\Microsoft\Windows\Explorer'
        - 'SOFTWARE\Policies\Microsoft\Windows\System'
selection_currentversion_explorer_system_key:
    CommandLine|contains:
        - 'ConsentPromptBehaviorAdmin'
        - 'DisableChangePassword'
        - 'DisableCMD'
        - 'DisableLockWorkstation'
        - 'DisableNotificationCenter'
        - 'DisableRegistryTools'
        - 'DisableTaskmgr'
        - 'HideSCAHealth'
        - 'HideSCANetwork'
        - 'HideSCAVolume'
        - 'InactivityTimeoutSecs'
        - 'NoClose'
        - 'NoControlPanel'
        - 'NoDesktop'
        - 'NoDispBackgroundPage'
        - 'NoDispCPL'
        - 'NoDrives'
        - 'NoFileMenu'
        - 'NoFind'
        - 'NoLogOff'
        - 'NoPropertiesMyDocuments'
        - 'NoRun'
        - 'NoSetTaskbar'
        - 'NoTrayContextMenu'
        - 'StartMenuLogOff'
        - 'shutdownwithoutlogon'
condition: all of selection_*

False positives (as the rule lists them)

• Legitimate use of reg.exe to change system settings

Tags

• attack.persistence
• attack.defense-impairment
• attack.t1112

MITRE ATT&CK ids this rule names

• T1112

Related rules

• e2482f8d-3443-4237-b906-cc145d87a076 (similar)

References

• https://bazaar.abuse.ch/sample/7bde840c7e8c36dce4c3bac937bcf39f36a6f118001b406bfbbc25451ce44fb4/
• https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
• https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions
• https://www.sentinelone.com/blog/cybervolk-returns-flawed-volklocker-brings-new-features-with-growing-pains/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_reg_internal_tools_setting_tampering.yml