Registry Tampering Of Internal Tools Settings

Title: Registry Tampering Of Internal Tools Settings
Status: experimental
Description:Detects registry modifications that tamper with internal Windows tools settings, commonly used by malware to disable security features or system tools
References:
  -https://bazaar.abuse.ch/sample/7bde840c7e8c36dce4c3bac937bcf39f36a6f118001b406bfbbc25451ce44fb4/
  -https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
  -https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions
  -https://www.sentinelone.com/blog/cybervolk-returns-flawed-volklocker-brings-new-features-with-growing-pains/
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-10-18
modified:None
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1112'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_reg_img:
Image|endswith:'\reg.exe' OriginalFileName:'reg.exe'   selection_reg_cli:
    CommandLine|contains: ' add '
  selection_currentversion_explorer_system_root:
    CommandLine|contains:
      -'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer'
      -'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
      -'SOFTWARE\Policies\Microsoft\Windows\Explorer'
      -'SOFTWARE\Policies\Microsoft\Windows\System'

  selection_currentversion_explorer_system_key:
    CommandLine|contains:
      -'ConsentPromptBehaviorAdmin'
      -'DisableChangePassword'
      -'DisableCMD'
      -'DisableLockWorkstation'
      -'DisableNotificationCenter'
      -'DisableRegistryTools'
      -'DisableTaskmgr'
      -'HideSCAHealth'
      -'HideSCANetwork'
      -'HideSCAVolume'
      -'InactivityTimeoutSecs'
      -'NoClose'
      -'NoControlPanel'
      -'NoDesktop'
      -'NoDispBackgroundPage'
      -'NoDispCPL'
      -'NoDrives'
      -'NoFileMenu'
      -'NoFind'
      -'NoLogOff'
      -'NoPropertiesMyDocuments'
      -'NoRun'
      -'NoSetTaskbar'
      -'NoTrayContextMenu'
      -'StartMenuLogOff'
      -'shutdownwithoutlogon'

  condition:all of selection_*
Falsepositives:
  -Legitimate use of reg.exe to change system settings
Level: medium