{"id":"22154f0e-5132-4a54-aa78-cc62f6def531","title":"Vulnerable Driver Blocklist Registry Tampering Via CommandLine","description":"Detects tampering of the Vulnerable Driver Blocklist registry via command line tools such as PowerShell or REG.EXE.\nThe Vulnerable Driver Blocklist is a security feature that helps prevent the loading of known vulnerable drivers.\nDisabling this feature may indicate an attempt to bypass security controls, often targeted by threat actors\nto facilitate the installation of malicious or vulnerable drivers, particularly in scenarios involving Endpoint Detection and Response\n","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-01-26","modified":"","tags":["attack.defense-impairment","attack.t1685"],"technique_ids":["T1685"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["It is very unlikely for legitimate activities to disable the Vulnerable Driver Blocklist via command line tools; thus it is recommended to investigate promptly."],"references":["https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution","https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules"],"source_path":"rules/windows/process_creation/proc_creation_win_vulnerable_driver_blocklist_registry_tampering.yml","source_sha256":"0efe7483ac8764bf892e99bee5694ae67c3ad22ceb8d8b840c8935b0ddf55b3e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_vulnerable_driver_blocklist_registry_tampering.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Vulnerable Driver Blocklist Registry Tampering Via CommandLine\nid: 22154f0e-5132-4a54-aa78-cc62f6def531\nrelated:\n    - id: d526c60a-e236-4011-b165-831ffa52ab70\n      type: similar\nstatus: experimental\ndescription: |\n    Detects tampering of the Vulnerable Driver Blocklist registry via command line tools such as PowerShell or REG.EXE.\n    The Vulnerable Driver Blocklist is a security feature that helps prevent the loading of known vulnerable drivers.\n    Disabling this feature may indicate an attempt to bypass security controls, often targeted by threat actors\n    to facilitate the installation of malicious or vulnerable drivers, particularly in scenarios involving Endpoint Detection and Response\nreferences:\n    - https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution\n    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules\nauthor: Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2026-01-26\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n              - '\\reg.exe'\n        - OriginalFileName:\n              - 'PowerShell.EXE'\n              - 'pwsh.dll'\n              - 'reg.exe'\n    selection_cli_1:\n        CommandLine|contains:\n            - 'add '\n            - 'New-ItemProperty '\n            - 'Set-ItemProperty '\n            - 'si '  # SetItem Alias\n    selection_cli_2:\n        CommandLine|contains|all:\n            - '\\Control\\CI\\Config'\n            - 'VulnerableDriverBlocklistEnable'\n    condition: all of selection_*\nfalsepositives:\n    - It is very unlikely for legitimate activities to disable the Vulnerable Driver Blocklist via command line tools; thus it is recommended to investigate promptly.\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_vulnerable_driver_blocklist_registry_tampering/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/22154f0e-5132-4a54-aa78-cc62f6def531.json","kind":"sigma"}