BIOC
Informational
✕
Windows Registry Editor being disabled via Registry
Registry Editor may be enabled / disabled using this key. This could indicate either IT policy applied or malicious activity preventing the user from altering the Registry.
- Module:
- Platform Analytics
- Agent event type:
- Registry
- Category:
- Evasion
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
Indicator:
Registry action type = all AND registry data != 0 AND registry key name = *\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System AND registry value name = DisableRegistryTools Host host os = windows
Preventable: yes