win:sysmon 13
RegistryEvent (Value Set)
This Registry event type identifies Registry value modifications.
- Log source
- Sysmon
- Host type
- Windows (workstation, member server, domain controller)
- How to enable
- Install Sysmon with a configuration that includes the matching rule group; see sysmon-modular for an ATT&CK-mapped configuration.
- Tier, host type
- Minimum
- Techniques
- 54
- Rules depending on it
- Splunk 178, Sigma 268, Elastic 53, Microsoft Sentinel 5
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstation | Minimum | |
| Windows member server | Minimum | |
| Windows domain controller | Minimum | |
| Windows web server (IIS), internet-facing | Minimum |
Techniques it helps detect
- T1003.001 LSASS Memory
- T1003.002 Security Account Manager
- T1012 Query Registry
- T1053.005 Scheduled Task
- T1056.001 Keylogging
- T1070 Indicator Removal
- T1082 System Information Discovery
- T1111 Multi-Factor Authentication Interception
- T1112 Modify Registry
- T1137 Office Application Startup
- T1137.001 Office Template Macros
- T1137.002 Office Test
- T1137.006 Add-ins
- T1176 Software Extensions
- T1176.001 Browser Extensions
- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1218.003 CMSTP
- T1218.009 Regsvcs/Regasm
- T1218.012 Verclsid
- T1218.014 MMC
- T1219 Remote Access Tools
- T1480 Execution Guardrails
- T1490 Inhibit System Recovery
- T1518.002 Backup Software Discovery
- T1543 Create or Modify System Process
- T1543.003 Windows Service
- T1546.001 Change Default File Association
- T1546.002 Screensaver
- T1546.008 Accessibility Features
- T1546.010 AppInit DLLs
- T1547 Boot or Logon Autostart Execution
- T1547.001 Registry Run Keys / Startup Folder
- T1547.003 Time Providers
- T1547.008 LSASS Driver
- T1547.010 Port Monitors
- T1547.012 Print Processors
- T1547.014 Active Setup
- T1548 Abuse Elevation Control Mechanism
- T1548.002 Bypass User Account Control
- T1552 Unsecured Credentials
- T1552.002 Credentials in Registry
- T1564 Hide Artifacts
- T1564.002 Hidden Users
- T1564.003 Hidden Window
- T1564.005 Hidden File System
- T1569 System Services
- T1569.002 Service Execution
- T1652 Device Driver Discovery
- T1685 Disable or Modify Tools
- T1685.001 Disable or Modify Windows Event Log
- T1686 Disable or Modify System Firewall
- T1686.003 Windows Host Firewall
- T1688 Safe Mode Boot
Rules that depend on it
400 of 504 rules are listed here: the dataset names at most this many per entry. The counts by vendor are complete.
Splunk 74 listed of 178
- Active Setup Registry Autostart
- Add DefaultUser And Password In Registry
- Allow Inbound Traffic By Firewall Rule Registry
- Allow Operation with Consent Admin
- Auto Admin Logon Registry Entry
- Detect Remote Access Software Usage Registry
- Disable AMSI Through Registry
- Disable Defender AntiVirus Registry
- Disable Defender BlockAtFirstSeen Feature
- Disable Defender Enhanced Notification
- Disable Defender MpEngine Registry
- Disable Defender Spynet Reporting
- Disable Defender Submit Samples Consent Feature
- Disable ETW Through Registry
- Disable Registry Tool
- Disable Security Logs Using MiniNt Registry
- Disable Show Hidden Files
- Disable UAC Remote Restriction
- Disable Windows App Hotkeys
- Disable Windows Behavior Monitoring
- Disable Windows SmartScreen Protection
- Disabling CMD Application
- Disabling ControlPanel
- Disabling Defender Services
- Disabling FolderOptions Windows Feature
- Disabling NoRun Windows App
- Disabling Remote User Account Control
- Disabling SystemRestore In Registry
- Disabling Task Manager
- Disabling Windows Local Security Authority Defences via Registry
- ETW Registry Disabled
- Enable RDP In Other Port Number
- Enable WDigest UseLogonCredential Registry
- Eventvwr UAC Bypass
- Hide User Account From Sign-In Screen
- Logon Script Event Trigger Execution
- Malicious InProcServer32 Modification
- Modification Of Wallpaper
- Monitor Registry Keys for Print Monitors
- NET Profiler UAC bypass
- Print Processor Registry Autostart
- Python PYTHONPATH Modification During Package Installation
- Registry Keys Used For Persistence
- Registry Keys Used For Privilege Escalation
- Registry Keys for Creating SHIM Databases
- Remcos client registry install entry
- Revil Registry Entry
- Screensaver Event Trigger Execution
- Sdclt UAC Bypass
- Set Default PowerShell Execution Policy To Unrestricted or Bypass
- SilentCleanup UAC Bypass
- Time Provider Persistence Registry
- WSReset UAC Bypass
- Windows AD DSRM Account Changes
- Windows Anomalous Registry Value Length in Environment Key
- Windows AppCertDLL Modification Via Registry
- Windows Audit Policy Auditing Option Modified - Registry
- Windows Autostart Execution LSASS Driver Registry Modification
- Windows Chrome Auto-Update Disabled via Registry
- Windows Chrome Extension Allowed Registry Modification
- Windows Compatibility Telemetry Tampering Through Registry
- Windows Content Copied from Browser was Executed
- Windows Defender Exclusion Registry Entry
- Windows Disable Change Password Through Registry
- Windows Disable Lock Workstation Feature Through Registry
- Windows Disable LogOff Button Through Registry
- Windows Disable Memory Crash Dump
- Windows Disable Notification Center
- Windows Disable Shutdown Button Through Registry
- Windows Disable Windows Group Policy Features Through Registry
- Windows DisableAntiSpyware Registry
- Windows Downdate Registry Activity
- Windows Enable Win32 ScheduledJob via Registry
- Windows Filtering Platform Policy Added to Block EDR Process
Sigma 268
- AMSI Disabled via Registry Modification by Swachchhanda Shrawan Poudel (Nextron Systems)
- Activate Suppression of Windows Security Center Notifications by frack113
- Add Authorized Applications to Microsoft Defender Firewall via Registry by frack113
- Add Debugger Entry To AeDebug For Persistence by Nasreddine Bencherchali (Nextron Systems)
- Add Debugger Entry To Hangs Key For Persistence by Nasreddine Bencherchali (Nextron Systems)
- Add DisallowRun Execution to Registry by frack113
- Add Port Monitor Persistence in Registry by frack113
- Allow Exceptions in Microsoft Defender Firewall via Registry by frack113
- Allow RDP Remote Assistance Feature by frack113
- Antivirus Filter Driver Disallowed On Dev Drive - Registry by @kostastsale, Nasreddine Bencherchali (Nextron Systems)
- Atbroker Registry Change by Mateusz Wydra, oscd.community
- Blackbyte Ransomware Registry by frack113
- Blue Mockingbird - Registry by Trent Liffick (@tliffick)
- Bypass UAC Using DelegateExecute by frack113
- Bypass UAC Using Event Viewer by frack113
- Bypass UAC Using SilentCleanup Task by frack113, Nextron Systems
- CMSTP App Paths Registry Key Modification by Nik Seetharaman
- COM Hijack via Sdclt by Omkar Gudhate
- COM Hijacking via TreatAs by frack113
- COM Object Hijacking Via Modification Of Default System CLSID Default Value by Nasreddine Bencherchali (Nextron Systems)
- CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry by EagleEye Team, Florian Roth (Nextron Systems), NVISO
- CVE-2021-31979 CVE-2021-33771 Exploits by Sittikorn S, frack113
- Change User Account Associated with the FAX Service by frack113
- Change Winevt Channel Access Permission Via Registry by frack113
- Change the Fax Dll by frack113
- Classes Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
- ClickOnce Trust Prompt Tampering by @SerkinValery, Nasreddine Bencherchali (Nextron Systems)
- Command Executed Via Run Dialog Box - Registry by Ahmed Farouk, Nasreddine Bencherchali
- Common Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name)
- CrashControl CrashDump Disabled by Tobias Michalski (Nextron Systems)
- Creation of a Local Hidden User Account by Registry by Christian Burkard (Nextron Systems)
- CurrentControlSet Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
- CurrentVersion Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
- CurrentVersion NT Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
- Custom File Open Handler Executes PowerShell by CD_R0M_
- DHCP Callout DLL Installation by Dimitrios Slamaris
- DLL Load via LSASS by Florian Roth (Nextron Systems)
- DNS-over-HTTPS Enabled by Registry by Austin Songer
- Default RDP Port Changed to Non Standard Port by frack113
- Diamond Sleet APT Scheduled Task Creation - Registry by Nasreddine Bencherchali (Nextron Systems)
- Directory Service Restore Mode(DSRM) Registry Value Tampering by Nischal Khadgi
- Disable Administrative Share Creation at Startup by frack113
- Disable Exploit Guard Network Protection on Windows Defender by Austin Songer @austinsonger
- Disable Internal Tools or Feature in Registry by frack113, Nasreddine Bencherchali (Nextron Systems), CrimpSec
- Disable Macro Runtime Scan Scope by Nasreddine Bencherchali (Nextron Systems)
- Disable Microsoft Defender Firewall via Registry by frack113
- Disable PUA Protection on Windows Defender by Austin Songer @austinsonger
- Disable Privacy Settings Experience in Registry by frack113
- Disable Security Events Logging Adding Reg Key MiniNt by Ilyas Ochkov, oscd.community
- Disable Tamper Protection on Windows Defender by Austin Songer @austinsonger
- Disable Windows Defender Functionalities Via Registry Keys by AlertIQ, Ján Trenčanský, frack113, Nasreddine Bencherchali, Swachchhanda Shrawan Poudel
- Disable Windows Event Logging Via Registry by frack113, Nasreddine Bencherchali (Nextron Systems)
- Disable Windows Firewall by Registry by frack113
- Disable Windows Security Center Notifications by frack113
- Disabled Windows Defender Eventlog by Florian Roth (Nextron Systems)
- Displaying Hidden Files Feature Disabled by frack113
- Driver Added To Disallowed Images In HVCI - Registry by Nasreddine Bencherchali (Nextron Systems), Omar Khaled (@beacon_exe)
- ETW Logging Disabled For SCM by Nasreddine Bencherchali (Nextron Systems)
- ETW Logging Disabled For rpcrt4.dll by Nasreddine Bencherchali (Nextron Systems)
- ETW Logging Disabled In .NET Processes - Sysmon Registry by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- Enable LM Hash Storage by Nasreddine Bencherchali (Nextron Systems)
- Enable Local Manifest Installation With Winget by Nasreddine Bencherchali (Nextron Systems)
- Enable Microsoft Dynamic Data Exchange by frack113
- Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback by X__Junior (Nextron Systems)
- Enabling COR Profiler Environment Variables by Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research), Jimmy Bayne (@bohops)
- Esentutl Volume Shadow Copy Service Keys by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- Execution DLL of Choice Using WAB.EXE by oscd.community, Natalia Shornikova
- FileFix - Command Evidence in TypedPaths by Alfie Champion (delivr.to), Swachchhanda Shrawan Poudel (Nextron Systems)
- FlowCloud Registry Markers by NVISO
- Forest Blizzard APT - Custom Protocol Handler Creation by Nasreddine Bencherchali (Nextron Systems)
- Forest Blizzard APT - Custom Protocol Handler DLL Registry Set by Nasreddine Bencherchali (Nextron Systems)
- Hide Schedule Task Via Index Value Tamper by Nasreddine Bencherchali (Nextron Systems)
- Hiding User Account Via SpecialAccounts Registry Key by Nasreddine Bencherchali (Nextron Systems), frack113
- HybridConnectionManager Service Installation - Registry by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- Hypervisor Enforced Paging Translation Disabled by Nasreddine Bencherchali (Nextron Systems)
- IE Change Domain Zone by frack113
- IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols by Nasreddine Bencherchali (Nextron Systems), Michael Haag (idea)
- Internet Explorer Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
- Internet Explorer DisableFirstRunCustomize Enabled by Nasreddine Bencherchali (Nextron Systems)
- Kapeka Backdoor Autorun Persistence by Swachchhanda Shrawan Poudel
- Kapeka Backdoor Configuration Persistence by Swachchhanda Shrawan Poudel
- Leviathan Registry Key Activity by Aidan Bracher
- Lolbas OneDriveStandaloneUpdater.exe Proxy Download by frack113
- Lsass Full Dump Request Via DumpType Registry Settings by @pbssubhash
- Macro Enabled In A Potentially Suspicious Document by Nasreddine Bencherchali (Nextron Systems)
- MaxMpxCt Registry Value Changed by Nasreddine Bencherchali (Nextron Systems)
- Microsoft Office Protected View Disabled by frack113, Nasreddine Bencherchali (Nextron Systems)
- Microsoft Office Trusted Location Updated by Nasreddine Bencherchali (Nextron Systems)
- Modification of IE Registry Settings by frack113
- Modify User Shell Folders Startup Value by frack113, Swachchhanda Shrawan Poudel (Nextron Systems)
- NET NGenAssemblyUsageLog Registry Key Tamper by frack113
- Narrator's Feedback-Hub Persistence by Dmitriy Lifanov, oscd.community
- NetNTLM Downgrade Attack - Registry by Florian Roth (Nextron Systems), wagga, Nasreddine Bencherchali (Splunk STRT)
- New Application in AppCompat by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- New BgInfo.EXE Custom DB Path Registry Configuration by Nasreddine Bencherchali (Nextron Systems)
- New BgInfo.EXE Custom VBScript Registry Configuration by Nasreddine Bencherchali (Nextron Systems)
- New BgInfo.EXE Custom WMI Query Registry Configuration by Nasreddine Bencherchali (Nextron Systems)
- New DLL Added to AppCertDlls Registry Key by Ilyas Ochkov, oscd.community
- New DLL Added to AppInit_DLLs Registry Key by Ilyas Ochkov, oscd.community, Tim Shelton
- New DNS ServerLevelPluginDll Installed by Florian Roth (Nextron Systems)
- New File Association Using Exefile by Andreas Hunkeler (@Karneades)
- New Netsh Helper DLL Registered From A Suspicious Location by Nasreddine Bencherchali (Nextron Systems)
- New ODBC Driver Registered by Nasreddine Bencherchali (Nextron Systems)
- New PortProxy Registry Entry Added by Andreas Hunkeler (@Karneades)
- New RUN Key Pointing to Suspicious Folder by Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing, Swachchhanda Shrawan Poudel (Nextron Systems)
- New Root or CA or AuthRoot Certificate to Store by frack113
- New TimeProviders Registered With Uncommon DLL Name by frack113
- OceanLotus Registry Activity by megan201296, Jonhnathan Ribeiro
- Office Application Startup - Office Test by omkar72
- Office Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
- Office Macros Warning Disabled by Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems)
- OilRig APT Registry Persistence by Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
- Old TLS1.0/TLS1.1 Protocol Version Enabled by Nasreddine Bencherchali (Nextron Systems)
- Outlook EnableUnsafeClientMailRules Setting Enabled - Registry by Nasreddine Bencherchali (Nextron Systems)
- Outlook Macro Execution Without Warning Setting Enabled by @ScoubiMtl
- Outlook Security Settings Updated - Registry by frack113
- Outlook Task/Note Reminder Received by Nasreddine Bencherchali (Nextron Systems)
- PUA - Sysinternal Tool Execution - Registry by Markus Neis
- PUA - Sysinternals Tools Execution - Registry by Nasreddine Bencherchali (Nextron Systems)
- Pandemic Registry Key by Florian Roth (Nextron Systems)
- Path To Screensaver Binary Modified by Bartlomiej Czyz @bczyz1, oscd.community
- Periodic Backup For System Registry Hives Enabled by Nasreddine Bencherchali (Nextron Systems)
- Persistence Via Disk Cleanup Handler - Autorun by Nasreddine Bencherchali (Nextron Systems)
- Persistence Via Hhctrl.ocx by Nasreddine Bencherchali (Nextron Systems)
- Persistence Via New SIP Provider by Nasreddine Bencherchali (Nextron Systems)
- Potential AMSI COM Server Hijacking by Nasreddine Bencherchali (Nextron Systems)
- Potential Attachment Manager Settings Associations Tamper by Nasreddine Bencherchali (Nextron Systems)
- Potential Attachment Manager Settings Attachments Tamper by Nasreddine Bencherchali (Nextron Systems)
- Potential AutoLogger Sessions Tampering by Nasreddine Bencherchali (Nextron Systems)
- Potential COLDSTEEL RAT Windows User Creation by Nasreddine Bencherchali (Nextron Systems)
- Potential COM Object Hijacking Via TreatAs Subkey - Registry by Kutepov Anton, oscd.community
- Potential ClickFix Execution Pattern - Registry by Swachchhanda Shrawan Poudel (Nextron Systems)
- Potential CobaltStrike Service Installations - Registry by Wojciech Lesicki
- Potential Credential Dumping Attempt Using New NetworkProvider - REG by Nasreddine Bencherchali (Nextron Systems)
- Potential Credential Dumping Via LSASS SilentProcessExit Technique by Florian Roth (Nextron Systems)
- Potential Encrypted Registry Blob Related To SNAKE Malware by Nasreddine Bencherchali (Nextron Systems)
- Potential EventLog File Location Tampering by D3F7A5105
- Potential HackTool - Defendnot Security Center AV Registry Modification by Swachchhanda Shrawan Poudel (Nextron Systems)
- Potential KamiKakaBot Activity - Winlogon Shell Persistence by Nasreddine Bencherchali (Nextron Systems), X__Junior
- Potential PSFactoryBuffer COM Hijacking by BlackBerry Threat Research and Intelligence Team - @Joseliyo_Jstnk
- Potential PendingFileRenameOperations Tampering by frack113
- Potential Persistence Using DebugPath by frack113
- Potential Persistence Via App Paths Default Property by Nasreddine Bencherchali (Nextron Systems)
- Potential Persistence Via AppCompat RegisterAppRestart Layer by Nasreddine Bencherchali (Nextron Systems)
- Potential Persistence Via AutodialDLL by Nasreddine Bencherchali (Nextron Systems)
- Potential Persistence Via CHM Helper DLL by Nasreddine Bencherchali (Nextron Systems)
- Potential Persistence Via Custom Protocol Handler by Nasreddine Bencherchali (Nextron Systems)
- Potential Persistence Via DLLPathOverride by Nasreddine Bencherchali (Nextron Systems)
- Potential Persistence Via Event Viewer Events.asp by Nasreddine Bencherchali (Nextron Systems)
- Potential Persistence Via Excel Add-in - Registry by frack113
- Potential Persistence Via GlobalFlags by Karneades, Jonhnathan Ribeiro, Florian Roth
- Potential Persistence Via LSA Extensions by Nasreddine Bencherchali (Nextron Systems)
- Potential Persistence Via Logon Scripts - Registry by Tom Ueltschi (@c_APT_ure)
- Potential Persistence Via Mpnotify by Nasreddine Bencherchali (Nextron Systems)
- Potential Persistence Via MyComputer Registry Keys by Nasreddine Bencherchali (Nextron Systems)
- Potential Persistence Via Netsh Helper DLL - Registry by Anish Bogati
- Potential Persistence Via New AMSI Providers - Registry by Nasreddine Bencherchali (Nextron Systems)
- Potential Persistence Via Outlook Home Page by Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand
- Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting by Nasreddine Bencherchali (Nextron Systems)
- Potential Persistence Via Outlook Today Page by Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand
- Potential Persistence Via Scrobj.dll COM Hijacking by frack113
- Potential Persistence Via Shim Database In Uncommon Location by Nasreddine Bencherchali (Nextron Systems)
- Potential Persistence Via Shim Database Modification by frack113
- Potential Persistence Via TypedPaths by Nasreddine Bencherchali (Nextron Systems)
- Potential Persistence Via Visual Studio Tools for Office by Bhabesh Raj
- Potential PowerShell Execution Policy Tampering by Nasreddine Bencherchali (Nextron Systems)
- Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG by Swachchhanda Shrawan Poudel
- Potential Qakbot Registry Activity by Hieu Tran
- Potential Ransomware Activity Using LegalNotice Message by frack113
- Potential Raspberry Robin Registry Set Internet Settings ZoneMap by Swachchhanda Shrawan Poudel
- Potential Registry Persistence Attempt Via DbgManagedDebugger by frack113
- Potential Registry Persistence Attempt Via Windows Telemetry by Lednyov Alexey, oscd.community, Sreeman
- Potential SentinelOne Shell Context Menu Scan Command Tampering by Nasreddine Bencherchali (Nextron Systems)
- Potential Signing Bypass Via Windows Developer Features - Registry by Nasreddine Bencherchali (Nextron Systems)
- Potential WSL InstallLocation Registry Key Modification by Liran Ravich, Swachchhanda Shrawan Poudel (Nextron Systems)
- Potential WerFault ReflectDebugger Registry Value Abuse by X__Junior
- Potentially Suspicious Command Executed Via Run Dialog Box - Registry by Ahmed Farouk, Nasreddine Bencherchali
- Potentially Suspicious Desktop Background Change Via Registry by Nasreddine Bencherchali (Nextron Systems), Stephen Lincoln @slincoln-aiq (AttackIQ)
- Potentially Suspicious ODBC Driver Registered by Nasreddine Bencherchali (Nextron Systems)
- PowerShell Logging Disabled Via Registry Key Tampering by frack113
- PowerShell Script Execution Policy Enabled by Nasreddine Bencherchali (Nextron Systems), Thurein Oo
- PowerShell as a Service in Registry by oscd.community, Natalia Shornikova
- PrinterNightmare Mimikatz Driver Name by Markus Neis, @markus_neis, Florian Roth
- Python Function Execution Security Warning Disabled In Excel - Registry by Nasreddine Bencherchali (Nextron Systems), @Kostastsale
- RDP Sensitive Settings Changed by Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali
- RDP Sensitive Settings Changed to Zero by Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali
- RedMimicry Winnti Playbook Registry Manipulation by Alexander Rausch
- Register New IFiltre For Persistence by Nasreddine Bencherchali (Nextron Systems)
- Registry Disable System Restore by frack113
- Registry Entries For Azorult Malware by Trent Liffick
- Registry Hide Function from User by frack113
- Registry Modification for OCI DLL Redirection by Swachchhanda Shrawan Poudel (Nextron Systems)
- Registry Modification to Hidden File Extension by frack113
- Registry Persistence Mechanisms in Recycle Bin by frack113
- Registry Persistence via Explorer Run Key by Florian Roth (Nextron Systems), oscd.community
- Registry Persistence via Service in Safe Mode by frack113
- Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace by Andreas Braathen (mnemonic.io)
- Registry Tampering by Potentially Suspicious Processes by Swachchhanda Shrawan Poudel (Nextron Systems)
- RestrictedAdminMode Registry Value Tampering by frack113
- Run Once Task Configuration in Registry by Avneet Singh @v3t0_, oscd.community
- Running Chrome VPN Extensions via the Registry 2 VPN Extension by frack113
- SNAKE Malware Covert Store Registry Key by Nasreddine Bencherchali (Nextron Systems)
- Scheduled Task Created - Registry by Center for Threat Informed Defense (CTID) Summiting the Pyramid Team
- Scheduled TaskCache Change by Uncommon Program by Syed Hasan (@syedhasan009)
- ScreenSaver Registry Key Set by Jose Luis Sanchez Martinez (@Joseliyo_Jstnk)
- Scripted Diagnostics Turn Off Check Enabled - Registry by Christopher Peacock @securepeacock, SCYTHE @scythe_io
- Security Event Logging Disabled via MiniNt Registry Key - Registry Set by Swachchhanda Shrawan Poudel (Nextron Systems)
- Security Support Provider (SSP) Added to LSA Configuration by iwillkeepwatch
- Service Binary in Suspicious Folder by Florian Roth (Nextron Systems), frack113
- Service Binary in User Controlled Folder by Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)
- ServiceDll Hijack by frack113
- Session Manager Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
- Shell Context Menu Command Tampering by Nasreddine Bencherchali (Nextron Systems)
- Shell Open Registry Keys Manipulation by Christian Burkard (Nextron Systems)
- Small Sieve Malware Registry Persistence by Nasreddine Bencherchali (Nextron Systems)
- Sticky Key Like Backdoor Usage - Registry by Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community
- Suspicious Application Allowed Through Exploit Guard by Nasreddine Bencherchali (Nextron Systems)
- Suspicious Camera and Microphone Access by Den Iuzvyk
- Suspicious Environment Variable Has Been Registered by Nasreddine Bencherchali (Nextron Systems)
- Suspicious Execution Of Renamed Sysinternals Tools - Registry by Nasreddine Bencherchali (Nextron Systems)
- Suspicious Keyboard Layout Load by Florian Roth (Nextron Systems)
- Suspicious Path In Keyboard Layout IME File Registry Value by X__Junior (Nextron Systems)
- Suspicious PowerShell In Registry Run Keys by frack113, Florian Roth (Nextron Systems)
- Suspicious Printer Driver Empty Manufacturer by Florian Roth (Nextron Systems)
- Suspicious Run Key from Download by Florian Roth (Nextron Systems), Swachchhanda Shrawan Poude (Nextron Systems)
- Suspicious Service Installed by xknow (@xknow_infosec), xorxes (@xor_xes)
- Suspicious Set Value of MSDT in Registry (CVE-2022-30190) by Sittikorn S
- Suspicious Shell Open Command Registry Modification by Swachchhanda Shrawan Poudel (Nextron Systems)
- Suspicious Shim Database Patching Activity by Nasreddine Bencherchali (Nextron Systems)
- Suspicious Space Characters in RunMRU Registry Path - ClickFix by Swachchhanda Shrawan Poudel (Nextron Systems)
- Suspicious Space Characters in TypedPaths Registry Path - FileFix by Swachchhanda Shrawan Poudel (Nextron Systems)
- Sysmon Driver Altitude Change by B.Talebi
- System Scripts Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
- Tamper With Sophos AV Registry Keys by Nasreddine Bencherchali (Nextron Systems)
- Trust Access Disable For VBApplications by Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems)
- UAC Bypass Abusing Winsat Path Parsing - Registry by Christian Burkard (Nextron Systems)
- UAC Bypass Using Windows Media Player - Registry by Christian Burkard (Nextron Systems)
- UAC Bypass Via Wsreset by oscd.community, Dmitry Uchakin
- UAC Bypass via Event Viewer by Florian Roth (Nextron Systems)
- UAC Bypass via Sdclt by Omer Yampel, Christian Burkard (Nextron Systems)
- UAC Disabled by frack113
- UAC Notification Disabled by frack113, Nasreddine Bencherchali (Nextron Systems)
- UAC Secure Desktop Prompt Disabled by frack113
- Uncommon Extension In Keyboard Layout IME File Registry Value by X__Junior (Nextron Systems)
- Uncommon Microsoft Office Trusted Location Added by Nasreddine Bencherchali (Nextron Systems)
- Usage of Renamed Sysinternals Tools - RegistrySet by Nasreddine Bencherchali (Nextron Systems)
- VBScript Payload Stored in Registry by Florian Roth (Nextron Systems)
- WFP Filter Added via Registry by Frack113
- WINEKEY Registry Modification by omkar72
- Wdigest CredGuard Registry Modification by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- Wdigest Enable UseLogonCredential by Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
- WinSock2 Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
- Windows Credential Editor Registry by Florian Roth (Nextron Systems)
- Windows Credential Guard Disabled - Registry by Swachchhanda Shrawan Poudel (Nextron Systems)
- Windows Defender Exclusions Added - Registry by Christian Burkard (Nextron Systems)
- Windows Defender Service Disabled - Registry by Ján Trenčanský, frack113, AlertIQ, Nasreddine Bencherchali
- Windows Defender Threat Severity Default Action Modified by Matt Anderson (Huntress)
- Windows Event Log Access Tampering Via Registry by X__Junior
- Windows Hypervisor Enforced Code Integrity Disabled by Nasreddine Bencherchali (Nextron Systems), Anish Bogati
- Windows Recall Feature Enabled - Registry by Sajid Nawaz Khan
- Windows Registry Trust Record Modification by Antonlovesdnb, Trent Liffick (@tliffick)
- Windows Vulnerable Driver Blocklist Disabled by Swachchhanda Shrawan Poudel (Nextron Systems)
- Winget Admin Settings Modification by Nasreddine Bencherchali (Nextron Systems)
- Winlogon AllowMultipleTSSessions Enable by Nasreddine Bencherchali (Nextron Systems)
- Winlogon Notify Key Logon Persistence by frack113
- Wow6432Node Classes Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
- Wow6432Node CurrentVersion Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
- Wow6432Node Windows NT CurrentVersion Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
Elastic 53
- Code Signing Policy Modification Through Registryinferred
- Creation of a Hidden Local User Accountinferred
- Creation or Modification of Root Certificateinferred
- DNS Global Query Block List Modified or Disabledinferred
- DNS-over-HTTPS Enabled via Registryinferred
- Disabling Lsa Protection via Registry Modificationinferred
- Disabling User Account Control via Registry Modificationinferred
- First Time Seen Removable Deviceinferred
- Full User-Mode Dumps Enabled System-Wideinferred
- Image File Execution Options Injectioninferred
- Installation of Custom Shim Databasesinferred
- Installation of Security Support Providerinferred
- Local Account TokenFilter Policy Disabledinferred
- MS Office Macro Security Registry Modificationsinferred
- Microsoft Windows Defender Tamperinginferred
- Modification of AmsiEnable Registry Keyinferred
- Modification of WDigest Security Providerinferred
- Netsh Helper DLLinferred
- Network Logon Provider Registry Modificationinferred
- Network-Level Authentication (NLA) Disabledinferred
- NullSessionPipe Registry Modificationinferred
- Office Test Registry Persistenceinferred
- Outlook Home Page Registry Modificationinferred
- Persistence via Hidden Run Key Detectedinferred
- Port Forwarding Rule Additioninferred
- Potential ClickFix Command via Windows Run Dialoginferred
- Potential FileFix Command via Windows Explorer Address Barinferred
- Potential NetNTLMv1 Downgrade Attackinferred
- Potential Persistence via Time Provider Modificationinferred
- Potential Privilege Escalation via Service ImagePath Modificationinferred
- Potential REMCOS Trojan Executioninferred
- Potential Remote Desktop Shadowing Activityinferred
- Potential RemoteMonologue Attackinferred
- Potential Uninstall Entry Concealmentinferred
- PowerShell Script Block Logging Disabledinferred
- Privilege Escalation via Windir Environment Variableinferred
- RDP Enabled via Registryinferred
- Registry Persistence via AppCert DLLinferred
- Registry Persistence via AppInit DLLinferred
- Remote Scheduled Task Creationinferred
- SIP Provider Modificationinferred
- Scheduled Task Created by a Windows Scriptinferred
- Scheduled Tasks AT Command Enabledinferred
- Service Path Modificationinferred
- SolarWinds Process Disabling Services via Registryinferred
- Suspicious ImagePath Service Creationinferred
- Suspicious Print Spooler Point and Print DLLinferred
- Suspicious Startup Shell Folder Modificationinferred
- Uncommon Registry Persistence Changeinferred
- Unusual Persistence via Services Registryinferred
- Werfault ReflectDebugger Persistenceinferred
- Windows Defender Disabled via Registry Modificationinferred
- Windows Subsystem for Linux Distribution Installedinferred
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Object and data eventsAppendix B item 5(3) | Supports an activity | our analysis: registry value set |
EDR events that stand in for it
Full: the sensor event carries what this event carries. Partial: the sensor reports a subset, so it does not replace the event.
| Product | Sensor event | Fidelity | Basis |
|---|---|---|---|
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | RegGenericValueUpdate | Full | pySigma-backend-crowdstrike: registry_event -> Reg*ValueUpdate family and AsepValueUpdate |
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | RegStringValueUpdate | Full | pySigma-backend-crowdstrike: registry_event -> Reg*ValueUpdate family and AsepValueUpdate |
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | RegDwordValueUpdate | Full | pySigma-backend-crowdstrike: registry_event -> Reg*ValueUpdate family and AsepValueUpdate |
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | RegQwordValueUpdate | Full | pySigma-backend-crowdstrike: registry_event -> Reg*ValueUpdate family and AsepValueUpdate |
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | RegBinaryValueUpdate | Full | pySigma-backend-crowdstrike: registry_event -> Reg*ValueUpdate family and AsepValueUpdate |
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | RegMultiStringValueUpdate | Full | pySigma-backend-crowdstrike: registry_event -> Reg*ValueUpdate family and AsepValueUpdate |
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | RegLinkValueUpdate | Full | pySigma-backend-crowdstrike: registry_event -> Reg*ValueUpdate family and AsepValueUpdate |
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | RegSystemConfigValueUpdate | Full | pySigma-backend-crowdstrike: registry_event -> Reg*ValueUpdate family and AsepValueUpdate |
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | AsepValueUpdate | Full | pySigma-backend-crowdstrike: registry_event -> Reg*ValueUpdate family and AsepValueUpdate |
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | AsepKeyUpdate | Full | pySigma-backend-crowdstrike: registry_event -> Reg*ValueUpdate family and AsepValueUpdate |
| CrowdStrike Falcon sensor telemetry (FDR event_simpleName) | RegistryOperationDetectInfo | Full | pySigma-backend-crowdstrike: registry_event -> Reg*ValueUpdate family and AsepValueUpdate |
| Microsoft Defender for Endpoint device tables | DeviceRegistryEvents | Full | pySigma-backend-kusto: Sysmon EventID 13 (value set) -> DeviceRegistryEvents (ActionType RegistryValueSet) |
| Elastic Defend endpoint events | registry | Full | Elastic Defend registry dataset |