Registry Tampering Of Internal Tools Settings

title: Registry Tampering Of Internal Tools Settings
id: ccc946a3-f65a-432a-bb6f-efc6acc1fd27
related:
    - id: e2482f8d-3443-4237-b906-cc145d87a076
      type: similar
status: experimental
description: Detects registry modifications that tamper with internal Windows tools settings, commonly used by malware to disable security features or system tools
references:
    - https://bazaar.abuse.ch/sample/7bde840c7e8c36dce4c3bac937bcf39f36a6f118001b406bfbbc25451ce44fb4/
    - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
    - https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions
    - https://www.sentinelone.com/blog/cybervolk-returns-flawed-volklocker-brings-new-features-with-growing-pains/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-10-18
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: process_creation
    product: windows
detection:
    selection_reg_img:
        - Image|endswith: '\reg.exe'
        - OriginalFileName: 'reg.exe'
    selection_reg_cli:
        CommandLine|contains: ' add '
    selection_currentversion_explorer_system_root:
        CommandLine|contains:
            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer'
            - 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'
            - 'SOFTWARE\Policies\Microsoft\Windows\Explorer'
            - 'SOFTWARE\Policies\Microsoft\Windows\System'
    selection_currentversion_explorer_system_key:
        CommandLine|contains:
            - 'ConsentPromptBehaviorAdmin'
            - 'DisableChangePassword'
            - 'DisableCMD'
            - 'DisableLockWorkstation'
            - 'DisableNotificationCenter'
            - 'DisableRegistryTools'
            - 'DisableTaskmgr'
            - 'HideSCAHealth'
            - 'HideSCANetwork'
            - 'HideSCAVolume'
            - 'InactivityTimeoutSecs'
            - 'NoClose'
            - 'NoControlPanel'
            - 'NoDesktop'
            - 'NoDispBackgroundPage'
            - 'NoDispCPL'
            - 'NoDrives'
            - 'NoFileMenu'
            - 'NoFind'
            - 'NoLogOff'
            - 'NoPropertiesMyDocuments'
            - 'NoRun'
            - 'NoSetTaskbar'
            - 'NoTrayContextMenu'
            - 'StartMenuLogOff'
            - 'shutdownwithoutlogon'
    condition: all of selection_*
falsepositives:
    - Legitimate use of reg.exe to change system settings
level: medium
simulation:
    - type: atomic-red-team
      name: Modify Registry of Current User Profile - cmd
      technique: T1112
      atomic_guid: 1324796b-d0f6-455a-b4ae-21ffee6aa6b9
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_internal_tools_setting_tampering/info.yml