Windows Recall Feature Enabled Via Reg.EXE — Sigma Rule

Rule metadata and linked tags

Author: Sajid Nawaz Khan. Source status: test; severity: medium. Source dates: 2024-06-02 / not supplied.

{
  "category": "process_creation",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: fc69e06e03f4b1c62159fa6d4ecc757af9f7173916567b74e1bd586541ec06e7

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Windows Recall Feature Enabled Via Reg.EXE
id: 817f252c-5143-4dae-b418-48c3e9f63728
related:
    - id: 5dfc1465-8f65-4fde-8eb5-6194380c6a62
      type: similar
    - id: 75180c5f-4ea1-461a-a4f6-6e4700c065d4
      type: similar
status: test
description: |
    Detects the enabling of the Windows Recall feature via registry manipulation.
    Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" value, or setting it to 0.
    Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities.
    This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
references:
    - https://learn.microsoft.com/en-us/windows/client-management/manage-recall
    - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis
author: Sajid Nawaz Khan
date: 2024-06-02
tags:
    - attack.collection
    - attack.t1113
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\reg.exe'
        - OriginalFileName: 'reg.exe'
    selection_value:
        # HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\WindowsAI\DisableAIDataAnalysis
        # HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsAI\DisableAIDataAnalysis
        CommandLine|contains|all:
            - 'Microsoft\Windows\WindowsAI'
            - 'DisableAIDataAnalysis'
    selection_action_add:
        CommandLine|contains:
            - 'add'
            - '0'
    selection_action_delete:
        CommandLine|contains: 'delete'
    condition: selection_img and selection_value and 1 of selection_action_*
falsepositives:
    - Legitimate use/activation of Windows Recall
level: medium

Original YAML and metadata in JSON

False positives

• Legitimate use/activation of Windows Recall

Source references

• https://learn.microsoft.com/en-us/windows/client-management/manage-recall
• https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis