cowWhySo/permission-command-corpus huggingface dataset:
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Win Defender Notification
Notes: Disable Win Defender Notification. Redline is using this to disable this win defender feature.
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Win Defender Notification
Notes: Disable Win Defender Notification. Redline is using this to disable this win defender feature.
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Windows OS Auto Update
Notes: Disable Auto Update Windows OS feature. Redline is using this as part of its defense evasion.
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Windows OS Auto Update
Notes: Disable Auto Update Windows OS feature. Redline is using this as part of its defense evasion.
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoRebootWithLoggedOnUsers" /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Windows Auto Reboot for current logon user
Notes: Disable Windows Auto Reboot for current logon user. Redline is using this as part of its defense evasion.
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoRebootWithLoggedOnUsers" /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Windows Auto Reboot for current logon user
Notes: Disable Windows Auto Reboot for current logon user. Redline is using this as part of its defense evasion.
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "AUOptions" /t REG_DWORD /d 2 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Windows Auto Update Option to Notify before download
Notes: Windows Auto Update Option to Notify before download. Redline is using this as part of its defense evasion.
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "AUOptions" /t REG_DWORD /d 3 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Windows Auto Update Option to Notify before download
Notes: Windows Auto Update Option to Notify before download. Redline is using this as part of its defense evasion.
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DoNotConnectToWindowsUpdateInternetLocations" /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Do Not Connect To Win Update
Notes: Do Not Connect To Win Update. Redline is using this as part of its defense evasion.
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DoNotConnectToWindowsUpdateInternetLocations" /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Do Not Connect To Win Update
Notes: Do Not Connect To Win Update. Redline is using this as part of its defense evasion.
Command: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Tamper Win Defender Protection
Notes: Tamper Win Defender Protection. RedLine Stealer is executing another component file to modify this win defender feature in registry. 
Take note that this modification might not be enough to disable this feature but can be a good indicator of malicious process that 
tries to tamper this Win Defender feature settings.
Command: reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d 5 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Tamper Win Defender Protection
Notes: Tamper Win Defender Protection. RedLine Stealer is executing another component file to modify this win defender feature in registry. 
Take note that this modification might not be enough to disable this feature but can be a good indicator of malicious process that 
tries to tamper this Win Defender feature settings.
Command: $typicalPath = "HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds"; $randomBytes = New-Object Byte[] 0x1000; (New-Object Random).NextBytes($randomBytes); New-ItemProperty -Path $typicalPath -Name "AtomicSnake" -Value $randomBytes -PropertyType Binary -Force | Out-Null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Snake Malware Registry Blob
Notes: The following Atomic Test creates a registry blob in HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds, which is related to Snake Malware. Per the report, upon execution, Snake's WerFault.exe will attempt to decrypt an encrypted blob within the Windows
registry that is typically found at HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds. The encrypted data includes the AES key, IV, and path that is used to find and decrypt the file containing Snake's kernel driver and kernel driver loader.
Command: $typicalPath = "HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds"; Remove-ItemProperty -Path $typicalPath -Name "AtomicSnake" -ErrorAction SilentlyContinue | Out-Null
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Snake Malware Registry Blob
Notes: The following Atomic Test creates a registry blob in HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds, which is related to Snake Malware. Per the report, upon execution, Snake's WerFault.exe will attempt to decrypt an encrypted blob within the Windows
registry that is typically found at HKLM:\SOFTWARE\Classes\.wav\OpenWithProgIds. The encrypted data includes the AES key, IV, and path that is used to find and decrypt the file containing Snake's kernel driver and kernel driver loader.
Command: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "MaxConnectionsPerServer" /t REG_DWORD /d 10 /f reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "MaxConnectionsPer1_0Server" /t REG_DWORD /d 10 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Allow Simultaneous Download Registry
Notes: A registry modification to allow Simultaneous download in the system.
Command: reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "MaxConnectionsPerServer" /f reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v "MaxConnectionsPer1_0Server" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Allow Simultaneous Download Registry
Notes: A registry modification to allow Simultaneous download in the system.
Command: reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults" /v http /t REG_DWORD /d 0 /F reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults" /v https /t REG_DWORD /d 0 /F
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify Internet Zone Protocol Defaults in Current User Registry - cmd
Notes: This test simulates an adversary modifying the Internet Zone Protocol Defaults in the registry of the currently logged-in user using the reg.exe utility via the command prompt. Such modifications can be indicative of an adversary trying to weaken browser security settings. Upon execution, if successful, the message "The operation completed successfully." will be displayed.
To verify the effects of the test:
1. Open the Registry Editor (regedit.exe).
2. Navigate to "HKEY_CURRENT_USER\SOFTWARE\Mic
Command: reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults" /v http /t REG_DWORD /d 3 /F reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults" /v https /t REG_DWORD /d 3 /F
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify Internet Zone Protocol Defaults in Current User Registry - cmd
Notes: This test simulates an adversary modifying the Internet Zone Protocol Defaults in the registry of the currently logged-in user using the reg.exe utility via the command prompt. Such modifications can be indicative of an adversary trying to weaken browser security settings. Upon execution, if successful, the message "The operation completed successfully." will be displayed.
To verify the effects of the test:
1. Open the Registry Editor (regedit.exe).
2. Navigate to "HKEY_CURRENT_USER\SOFTWARE\Mic
Command: # Set the registry values for http and https to 0 Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults' -Name 'http' -Value 0 Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults' -Name 'https' -Value 0
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify Internet Zone Protocol Defaults in Current User Registry - PowerShell
Notes: This test simulates an adversary modifying the Internet Zone Protocol Defaults in the registry of the currently logged-in user using PowerShell. Such modifications can be indicative of an adversary attempting to weaken browser security settings. 
To verify the effects of the test:
1. Open the Registry Editor (regedit.exe).
2. Navigate to "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults".
3. Check for the presence of the "http" and "https" DW
Command: # Restore the registry values for http and https to 3 Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults' -Name 'http' -Value 3 Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults' -Name 'https' -Value 3
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Modify Internet Zone Protocol Defaults in Current User Registry - PowerShell
Notes: This test simulates an adversary modifying the Internet Zone Protocol Defaults in the registry of the currently logged-in user using PowerShell. Such modifications can be indicative of an adversary attempting to weaken browser security settings. 
To verify the effects of the test:
1. Open the Registry Editor (regedit.exe).
2. Navigate to "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults".
3. Check for the presence of the "http" and "https" DW
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\SecondaryAuthenticationFactor" /v "AllowSecondaryAuthenticationDevice" /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Activities To Disable Secondary Authentication Detected By Modified Registry Value.
Notes: Detect the disable secondary authentication activities that adversary attempt to bypass MFA and to get the unauthorized access to the system or sensitive data.
See the related article (https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.SecondaryAuthenticationFactor::MSSecondaryAuthFactor_AllowSecondaryAuthenticationDevice).
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\SecondaryAuthenticationFactor" /v "AllowSecondaryAuthenticationDevice" /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Activities To Disable Secondary Authentication Detected By Modified Registry Value.
Notes: Detect the disable secondary authentication activities that adversary attempt to bypass MFA and to get the unauthorized access to the system or sensitive data.
See the related article (https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.SecondaryAuthenticationFactor::MSSecondaryAuthFactor_AllowSecondaryAuthenticationDevice).
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\FIDO" /v "AllowExternalDeviceSignon" /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Activities To Disable Microsoft [FIDO Aka Fast IDentity Online] Authentication Detected By Modified Registry Value.
Notes: Detect the Microsoft FIDO authentication disable activities that adversary attempt to gains access to login credentials (e.g., passwords), they may be able to impersonate the user and access sensitive accounts or data and also increases the risk of falling victim to phishing attacks.
See the related article (https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.FidoAuthentication::AllowFidoDeviceSignon).
Command: reg add "HKLM\SOFTWARE\Policies\Microsoft\FIDO" /v "AllowExternalDeviceSignon" /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Activities To Disable Microsoft [FIDO Aka Fast IDentity Online] Authentication Detected By Modified Registry Value.
Notes: Detect the Microsoft FIDO authentication disable activities that adversary attempt to gains access to login credentials (e.g., passwords), they may be able to impersonate the user and access sensitive accounts or data and also increases the risk of falling victim to phishing attacks.
See the related article (https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.FidoAuthentication::AllowFidoDeviceSignon).
Command: reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" /v AllowEncryptionOracle /t REG_DWORD /d 2 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Scarab Ransomware Defense Evasion Activities
Notes: Scarab Ransomware defense evasion activities that can abuse the registry values to modify the settings of the Credential Security Support Provider to overcome potential RDP connection issues.
[Scarab Ransomware Article](https://www.welivesecurity.com/en/eset-research/scarabs-colon-izing-vulnerable-servers/)
Command: reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\CredSSP\Parameters" /v AllowEncryptionOracle /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Scarab Ransomware Defense Evasion Activities
Notes: Scarab Ransomware defense evasion activities that can abuse the registry values to modify the settings of the Credential Security Support Provider to overcome potential RDP connection issues.
[Scarab Ransomware Article](https://www.welivesecurity.com/en/eset-research/scarabs-colon-izing-vulnerable-servers/)
Command: reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" /v "DisableRemoteDesktopAntiAlias" /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Remote Desktop Anti-Alias Setting Through Registry
Notes: A modification registry to disable RDP anti-alias settings. This technique was seen in DarkGate malware as part of its installation
Command: reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" /v "DisableRemoteDesktopAntiAlias" /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Remote Desktop Anti-Alias Setting Through Registry
Notes: A modification registry to disable RDP anti-alias settings. This technique was seen in DarkGate malware as part of its installation
Command: reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" /v "DisableSecuritySettings" /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Remote Desktop Security Settings Through Registry
Notes: A modification registry to disable RDP security settings. This technique was seen in DarkGate malware as part of its installation
Command: reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services" /v "DisableSecuritySettings" /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Remote Desktop Security Settings Through Registry
Notes: A modification registry to disable RDP security settings. This technique was seen in DarkGate malware as part of its installation
Command: reg add "HKCU\Software\Microsoft\Windows\Windows Error Reporting" /v DontShowUI /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disabling ShowUI Settings of Windows Error Reporting (WER)
Notes: A modification registry to disable ShowUI settings of Windows Error Report. This registry setting can influence the behavior of error reporting dialogs or prompt box. 
This technique was seen in DarkGate malware as part of its installation.
Command: reg add "HKCU\Software\Microsoft\Windows\Windows Error Reporting" /v DontShowUI /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disabling ShowUI Settings of Windows Error Reporting (WER)
Notes: A modification registry to disable ShowUI settings of Windows Error Report. This registry setting can influence the behavior of error reporting dialogs or prompt box. 
This technique was seen in DarkGate malware as part of its installation.
Command: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 1 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Enable Proxy Settings
Notes: A modification registry to enable proxy settings. This technique was seen in DarkGate malware as part of its installation.
Command: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Enable Proxy Settings
Notes: A modification registry to enable proxy settings. This technique was seen in DarkGate malware as part of its installation.
Command: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /t REG_SZ /d "proxy.atomic-test.com:8080" /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Set-Up Proxy Server
Notes: A modification registry to setup proxy server. This technique was seen in DarkGate malware as part of its installation.
Command: reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Set-Up Proxy Server
Notes: A modification registry to setup proxy server. This technique was seen in DarkGate malware as part of its installation.
Command: reg add "HKCU\Software\Microsoft\Terminal Server Client" /v AuthenticationLevelOverride /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: RDP Authentication Level Override
Notes: A modification registry to override RDP Authentication Level. This technique was seen in DarkGate malware as part of its installation.
Command: reg delete "HKCU\Software\Microsoft\Terminal Server Client" /v AuthenticationLevelOverride
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: RDP Authentication Level Override
Notes: A modification registry to override RDP Authentication Level. This technique was seen in DarkGate malware as part of its installation.
Command: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Enable RDP via Registry (fDenyTSConnections)
Notes: Modify the registry value of fDenyTSConnections to allow incoming RDP connections. 
This activity has been observed by multiple ransomware groups, including Hive ransomware. 
[Reference](https://www.rapid7.com/blog/post/2023/01/11/increasing-the-sting-of-hive-ransomware/)
Command: if #{remove_rdp_access_during_cleanup} EQU 1 (reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /f >nul 2>&1)
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Enable RDP via Registry (fDenyTSConnections)
Notes: Modify the registry value of fDenyTSConnections to allow incoming RDP connections. 
This activity has been observed by multiple ransomware groups, including Hive ransomware. 
[Reference](https://www.rapid7.com/blog/post/2023/01/11/increasing-the-sting-of-hive-ransomware/)
Command: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v "EnablePrefetcher" /t REG_DWORD /d 0 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Windows Prefetch Through Registry
Notes: Modify the registry of the machine to disable prefetch. Disabling prefetch will remove one artifact for evidence of application execution. Restart is required post modification
Command: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v "EnablePrefetcher" /t REG_DWORD /d 3 /f
Label: bad (risk class: suspicious, obfuscation: plain)
Category: T1112
Platform: windows
ATT&CK tags: T1112
Source rule: Disable Windows Prefetch Through Registry
Notes: Modify the registry of the machine to disable prefetch. Disabling prefetch will remove one artifact for evidence of application execution. Restart is required post modification