Skip to content
Permalink
master
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Azure-Sentinel/Hunting Queries/Microsoft 365 Defender/Ransomware/DEV-0270/Disabling Services via Registry.yaml

Go to file
 
 
Cannot retrieve contributors at this time
15 lines (15 sloc) 642 Bytes
Raw Blame
Open in GitHub Desktop
id: 3c6038db-c915-42f3-b20e-22ac7ebb1182
name: Disabling Services via Registry
description: |
Search for processes modifying the registry to disable security features.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
dataTypes:
- DeviceProcessEvents
tactics:
- Defense Evasion
query: |
DeviceProcessEvents
| where InitiatingProcessCommandLine has_all(@'"reg"', 'add', @'"HKLM\SOFTWARE\Policies\', '/v','/t', 'REG_DWORD', '/d', '/f')
and InitiatingProcessCommandLine has_any('DisableRealtimeMonitoring', 'UseTPMKey', 'UseTPMKeyPIN', 'UseAdvancedStartup',
'EnableBDEWithNoTPM', 'RecoveryKeyMessageSource')