Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects attempts to disable Windows Credential Guard by setting registry values to 0. Credential Guard uses virtualizati. Logsource: windows / registry_set. Rule: title: Windows Credential Guard Disabled - Registry id: 73921b9c-cafd-4446-b0c6-fdb0ace42bc0 related: - id: c17d47b7-dcd6-4109-87eb-d1817bd4cbc9 type: similar status: experimental description: 'Detects attempts to disable Windows Credential Guard by setting registry values to 0. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation. ' references: - https://woshub.com/disable-credential-guard-windows/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-26 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: - \DeviceGuard\EnableVirtualizationBasedSecurity - \DeviceGuard\LsaCfgFlags - \Lsa\LsaCfgFlags Details: DWORD (0x00000000) condition: selection falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_credential_guard_disabled/info.yml
Near-miss passage: Sigma rule: Detects registry value settings that would replace the user's desktop background. This is a common technique used by mal. Logsource: windows / registry_set. Rule: title: Potentially Suspicious Desktop Background Change Via Registry id: 85b88e05-dadc-430b-8a9e-53ff1cd30aae related: - id: 8cbc9475-8d05-4e27-9c32-df960716c701 type: similar status: test description: 'Detects registry value settings that would replace the user''s desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image. ' references: - https://www.attackiq.com/2023/09/20/emulating-rhysida/ - https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/ - https://www.trendmicro.com/en_us/research/23/h/an-overview-of-the-new-rhysida-ransomware.html - https://www.virustotal.com/gui/file/a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6/behavior - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsDesktop::Wallpaper - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.ControlPanelDisplay::CPL_Personalization_NoDesktopBackgroundUI author: Nasreddine Bencherchali (Nextron Systems), Stephen Lincoln @slincoln-aiq (AttackIQ) date: 2023-12-21 modified: 2025-10-17 tags: - attack.persistence - attack.impact - attack.defense-impairment - attack.t1112 - attack.t1491.001 logsource: product: windows category: registry_set detection: selection_keys: TargetObject|contains: - Control Panel\Desktop - CurrentVersion\Policies\ActiveDesktop - CurrentVersion\Policies\System selection_values_1: TargetObject|endswith: NoChangingWallpaper Details: DWORD (0x00000001) selection_values_2: TargetObject|endswith: \Wallpaper selection_values_3: TargetObject|endswith: \WallpaperStyle Details: '2' filter_main_svchost: Image|endswith: \svchost.exe filter_main_empty: TargetObject|endswith: \Control Panel\Desktop\Wallpaper Details: (Empty) filter_main_explorer: Image|endswith: C:\Windows\Explorer.EXE filter_optional_ec2launch: Image: - C:\Program Files\Amazon\EC2Launch\EC2Launch.exe - C:\Program Files (x86)\Amazon\EC2Launch\EC2Launch.exe TargetObject|endswith: \Control Panel\Desktop\Wallpaper condition: selection_keys and 1 of selection_values_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Administrative scripts that change the desktop background to a company logo or other image. level: medium