Write Protect For Storage Disabled

Title: Write Protect For Storage Disabled
Status: test
Description:Detects applications trying to modify the registry in order to disable any write-protect property for storage devices. This could be a precursor to a ransomware attack and has been an observed technique used by cypherpunk group.
References:
  -https://www.manageengine.com/products/desktop-central/os-imaging-deployment/media-is-write-protected.html
Author: Sreeman
Date: 2021-06-11
modified:2024-01-18
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
    CommandLine|contains|all:
      -'\System\CurrentControlSet\Control'
      -'Write Protection'
      -'0'
      -'storage'

  condition:selection
Falsepositives:
  -Unknown
Level: medium