Scripted Diagnostics Turn Off Check Enabled - Registry

Title: Scripted Diagnostics Turn Off Check Enabled - Registry
Status: test
Description:Detects enabling TurnOffCheck which can be used to bypass defense of MSDT Follina vulnerability
References:
  -https://twitter.com/wdormann/status/1537075968568877057?s=20&t=0lr18OAnmAGoGpma6grLUw
Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io
Date: 2022-06-15
modified:2023-08-17
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: windows
• category: registry_set

Detection:
  selection:
    TargetObject|endswith: '\Policies\Microsoft\Windows\ScriptedDiagnostics\TurnOffCheck'
    Details: 'DWORD (0x00000001)'
  condition:selection
Falsepositives:
  -Administrator actions
Level: medium