deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Activate Suppression of Windows Security Center Notifications
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-08-19
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detect set Notification_Suppress to 1 to disable the Windows security center notification

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "SOFTWARE\\Policies\\Microsoft\\Windows Defender\\UX Configuration\\Notification_Suppress",
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb[PII_REDACTED]6735a1fd15/atomics/T1112/T1112.md
Sigma Detection Rule: Potential Persistence Via Outlook Today Page
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand
Date: 2021-06-10
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects potential persistence activity via outlook today page.
An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl".


Detection logic:
{
  "selection_main": {
    "TargetObject|contains|all": [
      "Software\\Microsoft\\Office\\",
      "\\Outlook\\Today\\"
    ]
  },
  "selection_value_stamp": {
    "TargetObject|endswith": "\\Stamp",
    "Details": "DWORD (0x00000001)"
  },
  "selection_value_url": {
    "TargetObject|endswith": [
      "\\URL",
      "\\UserDefinedUrl"
    ]
  },
  "filter_main_office": {
    "Image|startswith": [
      "C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\",
      "C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\Updates\\"
    ],
    "Image|endswith": "\\OfficeClickToRun.exe"
  },
  "condition": "selection_main and 1 of selection_value_* and not 1 of filter_main_*"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=74
  - https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change
Sigma Detection Rule: Persistence Via Hhctrl.ocx
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-21
Log source: windows/registry_set

Description:
Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\CLSID\\{52A2AAAE-085D-4187-97EA-8C30DB990436}\\InprocServer32\\(Default)"
  },
  "filter": {
    "Details": "C:\\Windows\\System32\\hhctrl.ocx"
  },
  "condition": "selection and not filter"
}

References:
  - https://persistence-info.github.io/Data/hhctrl.html
  - https://www.hexacorn.com/blog/2018/04/23/beyond-good-ol-run-key-part-77/
Sigma Detection Rule: Potential Persistence Via Excel Add-in - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2023-01-15
ATT&CK techniques: T1137.006
Log source: windows/registry_set

Description:
Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.

Detection logic:
{
  "selection": {
    "TargetObject|contains": "Software\\Microsoft\\Office\\",
    "TargetObject|endswith": "\\Excel\\Options",
    "Details|startswith": "/R ",
    "Details|endswith": ".xll"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md
  - https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence
Sigma Detection Rule: UAC Secure Desktop Prompt Disabled
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2024-05-10
ATT&CK techniques: T1548.002
Log source: windows/registry_set

Description:
Detects when an attacker tries to change User Account Control (UAC) elevation request destination via the "PromptOnSecureDesktop" value.
The "PromptOnSecureDesktop" setting specifically determines whether UAC prompts are displayed on the secure desktop. The secure desktop is a separate desktop environment that's isolated from other processes running on the system. It's designed to prevent malicious software from intercepting or tampering with UAC prompts.
When "PromptOnSecureDesktop" is set to 0, UAC prompts are displayed on the user's current desktop instead of the secure desktop. This reduces the level of security because it potentially exposes the prompts to manipulation by malicious software.


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\PromptOnSecureDesktop",
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/7e11e9b79583545f208a6dc3fa062f2ed443d999/atomics/T1548.002/T1548.002.md
Sigma Detection Rule: Potential Persistence Via MyComputer Registry Keys
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-09
Log source: windows/registry_set

Description:
Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer",
    "TargetObject|endswith": "(Default)"
  },
  "condition": "selection"
}

References:
  - https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/
Sigma Detection Rule: Disable Privacy Settings Experience in Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-10-02
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects registry modifications that disable Privacy Settings Experience

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\SOFTWARE\\Policies\\Microsoft\\Windows\\OOBE\\DisablePrivacyExperience",
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1562.001/T1562.001.md
Sigma Detection Rule: Windows Credential Guard Disabled - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-12-26
ATT&CK techniques: T1685
Log source: windows/registry_set

Description:
Detects attempts to disable Windows Credential Guard by setting registry values to 0. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them.
Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation.


Detection logic:
{
  "selection": {
    "TargetObject|endswith": [
      "\\DeviceGuard\\EnableVirtualizationBasedSecurity",
      "\\DeviceGuard\\LsaCfgFlags",
      "\\Lsa\\LsaCfgFlags"
    ],
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://woshub.com/disable-credential-guard-windows/
Sigma Detection Rule: Internet Explorer Autorun Keys Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
Date: 2019-10-25
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detects modification of autostart extensibility point (ASEP) in registry.

Detection logic:
{
  "ie": {
    "TargetObject|contains": [
      "\\Software\\Wow6432Node\\Microsoft\\Internet Explorer",
      "\\Software\\Microsoft\\Internet Explorer"
    ]
  },
  "ie_details": {
    "TargetObject|contains": [
      "\\Toolbar",
      "\\Extensions",
      "\\Explorer Bars"
    ]
  },
  "filter_empty": {
    "Details": "(Empty)"
  },
  "filter_extensions": {
    "TargetObject|contains": [
      "\\Extensions\\{2670000A-7350-4f3c-8081-5663EE0C6C49}",
      "\\Extensions\\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}",
      "\\Extensions\\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}",
      "\\Extensions\\{A95fe080-8f5d-11d2-a20b-00aa003c157a}"
    ]
  },
  "filter_toolbar": {
    "TargetObject|endswith": [
      "\\Toolbar\\ShellBrowser\\ITBar7Layout",
      "\\Toolbar\\ShowDiscussionButton",
      "\\Toolbar\\Locked"
    ]
  },
  "condition": "ie and ie_details and not 1 of filter_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
  - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
  - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d
Sigma Detection Rule: Potentially Suspicious Desktop Background Change Via Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Stephen Lincoln @slincoln-aiq (AttackIQ)
Date: 2023-12-21
ATT&CK techniques: T1112, T1491.001
Log source: windows/registry_set

Description:
Detects registry value settings that would replace the user's desktop background.
This is a common technique used by malware to change the desktop background to a ransom note or other image.


Detection logic:
{
  "selection_keys": {
    "TargetObject|contains": [
      "Control Panel\\Desktop",
      "CurrentVersion\\Policies\\ActiveDesktop",
      "CurrentVersion\\Policies\\System"
    ]
  },
  "selection_values_1": {
    "TargetObject|endswith": "NoChangingWallpaper",
    "Details": "DWORD (0x00000001)"
  },
  "selection_values_2": {
    "TargetObject|endswith": "\\Wallpaper"
  },
  "selection_values_3": {
    "TargetObject|endswith": "\\WallpaperStyle",
    "Details": "2"
  },
  "filter_main_svchost": {
    "Image|endswith": "\\svchost.exe"
  },
  "filter_main_empty": {
    "TargetObject|endswith": "\\Control Panel\\Desktop\\Wallpaper",
    "Details": "(Empty)"
  },
  "filter_main_explorer": {
    "Image|endswith": "C:\\Windows\\Explorer.EXE"
  },
  "filter_optional_ec2launch": {
    "Image": [
      "C:\\Program Files\\Amazon\\EC2Launch\\EC2Launch.exe",
      "C:\\Program Files (x86)\\Amazon\\EC2Launch\\EC2Launch.exe"
    ],
    "TargetObject|endswith": "\\Control Panel\\Desktop\\Wallpaper"
  },
  "condition": "selection_keys and 1 of selection_values_* and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://www.attackiq.com/2023/09/20/emulating-rhysida/
  - https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/
  - https://www.trendmicro.com/en_us/research/23/h/an-overview-of-the-new-rhysida-ransomware.html
  - https://www.virustotal.com/gui/file/a864282fea5a536510ae86c77ce46f[PII_REDACTED]628e4f2ceb5bf2c41b8cd3c6/behavior
  - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsDesktop::Wallpaper
Sigma Detection Rule: Potential PowerShell Execution Policy Tampering
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-11
Log source: windows/registry_set

Description:
Detects changes to the PowerShell execution policy in order to bypass signing requirements for script execution

Detection logic:
{
  "selection": {
    "TargetObject|endswith": [
      "\\ShellIds\\Microsoft.PowerShell\\ExecutionPolicy",
      "\\Policies\\Microsoft\\Windows\\PowerShell\\ExecutionPolicy"
    ],
    "Details|contains": [
      "Bypass",
      "Unrestricted"
    ]
  },
  "filter_main_svchost": {
    "Image|contains": [
      ":\\Windows\\System32\\",
      ":\\Windows\\SysWOW64\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.3
Sigma Detection Rule: Potential AutoLogger Sessions Tampering
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-01
ATT&CK techniques: T1685.001
Log source: windows/registry_set

Description:
Detects tampering with autologger trace sessions which is a technique used by attackers to disable logging.
The AutoLogger event tracing session records events up that occur early in the operating system boot process.
Applications and device drivers can use the AutoLogger session to capture traces before the user logs in, and also used by security solutions as telemetry source.
Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events.


Detection logic:
{
  "selection_main": {
    "TargetObject|contains": "\\Control\\WMI\\Autologger\\"
  },
  "selection_values": {
    "TargetObject|contains": [
      "\\EventLog-",
      "\\Defender"
    ],
    "TargetObject|endswith": [
      "\\Enabled",
      "\\Start"
    ],
    "Details": "DWORD (0x00000000)"
  },
  "filter_main_wevtutil": {
    "Image": "C:\\Windows\\system32\\wevtutil.exe"
  },
  "filter_main_defender": {
    "Image|startswith": [
      "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\",
      "C:\\Program Files\\Windows Defender\\",
      "C:\\Program Files (x86)\\Windows Defender\\"
    ],
    "Image|endswith": "\\MsMpEng.exe",
    "TargetObject|contains": [
      "\\DefenderApiLogger\\",
      "\\DefenderAuditLogger\\"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://twitter.com/MichalKoczwara/status/[PII_REDACTED]16498688
  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
  - https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf
  - https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
Sigma Detection Rule: Custom File Open Handler Executes PowerShell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: CD_R0M_
Date: 2022-06-11
ATT&CK techniques: T1202
Log source: windows/registry_set

Description:
Detects the abuse of custom file open handler, executing powershell

Detection logic:
{
  "selection": {
    "TargetObject|contains": "shell\\open\\command\\",
    "Details|contains|all": [
      "powershell",
      "-command"
    ]
  },
  "condition": "selection"
}

References:
  - https://news.sophos.com/en-us/2022/02/01/solarmarker-campaign-used-novel-registry-changes-to-establish-persistence/?cmp=30728
Sigma Detection Rule: VBScript Payload Stored in Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-03-05
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detects VBScript content stored into registry keys as seen being used by UNC2452 group

Detection logic:
{
  "selection": {
    "TargetObject|contains": "Software\\Microsoft\\Windows\\CurrentVersion",
    "Details|contains": [
      "vbscript:",
      "jscript:",
      "mshtml,",
      "RunHTMLApplication",
      "Execute(",
      "CreateObject",
      "window.close"
    ]
  },
  "filter": {
    "TargetObject|contains": "Software\\Microsoft\\Windows\\CurrentVersion\\Run"
  },
  "filter_dotnet": {
    "Image|endswith": "\\msiexec.exe",
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\",
    "Details|contains": [
      "\\Microsoft.NET\\Primary Interop Assemblies\\Microsoft.mshtml.dll",
      "<\\Microsoft.mshtml,fileVersion=",
      "_mshtml_dll_",
      "<\\Microsoft.mshtml,culture="
    ]
  },
  "condition": "selection and not 1 of filter*"
}

References:
  - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
Sigma Detection Rule: Enable Microsoft Dynamic Data Exchange
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-02-26
ATT&CK techniques: T1559.002
Log source: windows/registry_set

Description:
Enable Dynamic Data Exchange protocol (DDE) in all supported editions of Microsoft Word or Excel.

Detection logic:
{
  "selection_word": {
    "TargetObject|endswith": "\\Word\\Security\\AllowDDE",
    "Details": [
      "DWORD (0x00000001)",
      "DWORD (0x00000002)"
    ]
  },
  "selection_excel": {
    "TargetObject|endswith": [
      "\\Excel\\Security\\DisableDDEServerLaunch",
      "\\Excel\\Security\\DisableDDEServerLookup"
    ],
    "Details": "DWORD (0x00000000)"
  },
  "condition": "1 of selection_*"
}

References:
  - https://msrc.microsoft.com/update-guide/vulnerability/ADV170021
Sigma Detection Rule: Winget Admin Settings Modification
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-17
Log source: windows/registry_set

Description:
Detects changes to the AppInstaller (winget) admin settings. Such as enabling local manifest installations or disabling installer hash checks

Detection logic:
{
  "selection": {
    "Image|endswith": "\\winget.exe",
    "TargetObject|startswith": "\\REGISTRY\\A\\",
    "TargetObject|endswith": "\\LocalState\\admin_settings"
  },
  "condition": "selection"
}

References:
  - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
  - https://github.com/microsoft/winget-cli/blob/02d2f93807c9851d73eaacb4d8811a76b64b7b01/src/AppInstallerCommonCore/Public/winget/AdminSettings.h#L13
Sigma Detection Rule: Office Macros Warning Disabled
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems)
Date: 2020-05-22
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, whether signed or unsigned.

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Security\\VBAWarnings",
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/inversecos/status/[PII_REDACTED]21819397
  - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/
  - https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/
Sigma Detection Rule: Disable Windows Firewall by Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-08-19
ATT&CK techniques: T1686.003
Log source: windows/registry_set

Description:
Detect set EnableFirewall to 0 to disable the Windows firewall

Detection logic:
{
  "selection": {
    "TargetObject|endswith": [
      "\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\StandardProfile\\EnableFirewall",
      "\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\EnableFirewall"
    ],
    "Details": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb[PII_REDACTED]6735a1fd15/atomics/T1562.004/T1562.004.md
Sigma Detection Rule: IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Michael Haag (idea)
Date: 2023-09-05
Log source: windows/registry_set

Description:
Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProtocolDefaults",
    "TargetObject|endswith": [
      "\\http",
      "\\https"
    ],
    "Details|contains": "DWORD (0x00000000)"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/M_haggis/status/[PII_REDACTED]54725107
  - https://twitter.com/JAMESWT_MHT/status/[PII_REDACTED]61391247
  - https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries
  - https://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content
Sigma Detection Rule: Registry Explorer Policy Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-03-18
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this technique)

Detection logic:
{
  "selection_set_1": {
    "TargetObject|endswith": [
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoLogOff",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoDesktop",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFind",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFileMenu",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetTaskbar",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyDocuments",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoTrayContextMenu"
    ],
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection_set_1"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md