Sigma rule: Disable Internal Tools or Feature in Registry

Rule

Title

Disable Internal Tools or Feature in Registry

Status

test

Level

medium

Author

frack113, Nasreddine Bencherchali (Nextron Systems), CrimpSec

Date

2022-03-18

Modified

2026-10-18

File

rules/windows/registry/registry_set/registry_set_disable_function_user.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects registry modifications that change features of internal Windows tools (malware like Agent Tesla uses this technique)

Log source

product

windows

category

registry_set

Detection

selection_set_1:
    TargetObject|endswith:
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisableCMD'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCANetwork'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAVolume'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileMenu'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogOff'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyDocuments'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\StartMenuLogOff'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableChangePassword'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskmgr'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispCPL'
        - 'SOFTWARE\Policies\Microsoft\Windows\Explorer\DisableNotificationCenter'
        - 'SOFTWARE\Policies\Microsoft\Windows\System\DisableCMD'
    Details: 'DWORD (0x00000001)'
selection_set_2:
    TargetObject|endswith: 'SOFTWARE\Policies\Microsoft\Windows\System\DisableCMD'
    Details: 'DWORD (0x00000002)'
selection_set_0:
    TargetObject|endswith:
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\InactivityTimeoutSecs'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon'
        - 'SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\ToastEnabled'
        - 'SYSTEM\CurrentControlSet\Control\Storage\Write Protection'
        - 'SYSTEM\CurrentControlSet\Control\StorageDevicePolicies\WriteProtect'
    Details: 'DWORD (0x00000000)'
condition: 1 of selection_set_*

False positives (as the rule lists them)

• Legitimate script or Group Policy (GPO) configuration by administrators

Tags

• attack.persistence
• attack.defense-impairment
• attack.t1112

MITRE ATT&CK ids this rule names

• T1112

Related rules

• 1c3121ed-041b-4d97-a075-07f54f20fb4a (obsolete)
• ccc946a3-f65a-432a-bb6f-efc6acc1fd27 (similar)

References

• https://bazaar.abuse.ch/sample/7bde840c7e8c36dce4c3bac937bcf39f36a6f118001b406bfbbc25451ce44fb4/
• https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
• https://www.malwarebytes.com/blog/detections/pum-optional-nodispbackgroundpage
• https://www.malwarebytes.com/blog/detections/pum-optional-nodispcpl
• https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions
• https://www.sentinelone.com/blog/cybervolk-returns-flawed-volklocker-brings-new-features-with-growing-pains/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_disable_function_user.yml