Scripted Diagnostics Turn Off Check Enabled - Registry — Sigma Rule

Rule metadata and linked tags

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io. Source status: test; severity: medium. Source dates: 2022-06-15 / 2023-08-17.

{
  "product": "windows",
  "category": "registry_set"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 44ab5b7f413bb57bc8cca7afc57325e460db430255619b630d9b21aa9786ce89

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Scripted Diagnostics Turn Off Check Enabled - Registry
id: 7d995e63-ec83-4aa3-89d5-8a17b5c87c86
status: test
description: Detects enabling TurnOffCheck which can be used to bypass defense of MSDT Follina vulnerability
references:
    - https://twitter.com/wdormann/status/1537075968568877057?s=20&t=0lr18OAnmAGoGpma6grLUw
author: 'Christopher Peacock @securepeacock, SCYTHE @scythe_io'
date: 2022-06-15
modified: 2023-08-17
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|endswith: '\Policies\Microsoft\Windows\ScriptedDiagnostics\TurnOffCheck'
        Details: 'DWORD (0x00000001)'
    condition: selection
falsepositives:
    - Administrator actions
level: medium

Original YAML and metadata in JSON

False positives

• Administrator actions

Source references

• https://twitter.com/wdormann/status/1537075968568877057?s=20&t=0lr18OAnmAGoGpma6grLUw