BIOC Low

Windows File Protection being disabled via Registry

Windows File Protection (WFP) prevents programs from replacing critical Windows system files. Programs must not overwrite these files because they are used by the operating system and by other programs. Protecting these files prevents problems with programs and the operating system.

Module:
Platform Analytics
Agent event type:
Registry
Category:
Tampering
Status:
Enabled
ATT&CK tactics: Impact (TA0040)
ATT&CK techniques: Inhibit System Recovery (T1490)
Indicator:

Registry action type = all AND registry data = 1 AND registry key name = *SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable Host host os = windows

Preventable: yes