Skip to content

Commit d64c2c9

Browse files
mike-hunhoffmike-hunhoff
authored
add new rules to detect disabling system features via registry on Windows (#1034)
* add new rules to detect disabling features via registry on Windows * refactor * refactor * refactor * update control registry regex to better handle multiple control sets
1 parent 7269873 commit d64c2c9

21 files changed

+208
-42
lines changed

‎anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings-targeting-virtualbox.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,11 @@ rule:
2525
- string: /HARDWARE\\ACPI\\FADT\\VBOX__/i
2626
- string: /HARDWARE\\ACPI\\RSDT\\VBOX__/i
2727
- string: /SOFTWARE\\Oracle\\VirtualBox Guest Additions/i
28-
- string: /SYSTEM\\ControlSet001\\Services\\VBoxGuest/i
29-
- string: /SYSTEM\\ControlSet001\\Services\\VBoxMouse/i
30-
- string: /SYSTEM\\ControlSet001\\Services\\VBoxService/i
31-
- string: /SYSTEM\\ControlSet001\\Services\\VBoxSF/i
32-
- string: /SYSTEM\\ControlSet001\\Services\\VBoxVideo/i
28+
- string: /SYSTEM\\(ControlSet\d{3}|CurrentControlSet)\\Services\\VBoxGuest/i
29+
- string: /SYSTEM\\(ControlSet\d{3}|CurrentControlSet)\\Services\\VBoxMouse/i
30+
- string: /SYSTEM\\(ControlSet\d{3}|CurrentControlSet)\\Services\\VBoxService/i
31+
- string: /SYSTEM\\(ControlSet\d{3}|CurrentControlSet)\\Services\\VBoxSF/i
32+
- string: /SYSTEM\\(ControlSet\d{3}|CurrentControlSet)\\Services\\VBoxVideo/i
3333
- string: /VBoxMouse\.sys/i
3434
- string: /VBoxGuest\.sys/i
3535
- string: /VBoxSF\.sys/i

‎anti-analysis/anti-vm/vm-detection/reference-anti-vm-strings.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@ rule:
2222
- string: /HARDWARE\\DESCRIPTION\\System\\(SystemBiosVersion|VideoBiosVersion)/i
2323
- string: /HARDWARE\\DESCRIPTION\\System\\CentralProcessor/i
2424
- string: /HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0/i
25-
- string: /SYSTEM\\(CurrentControlSet|ControlSet001)\\Enum\\IDE/i
26-
- string: /SYSTEM\\(CurrentControlSet|ControlSet001)\\Services\\Disk\\Enum\\/i
27-
- string: /SYSTEM\\(CurrentControlSet|ControlSet001)\\Control\\SystemInformation\\SystemManufacturer/i
25+
- string: /SYSTEM\\(ControlSet\d{3}|CurrentControlSet)\\Enum\\IDE/i
26+
- string: /SYSTEM\\(ControlSet\d{3}|CurrentControlSet)\\Services\\Disk\\Enum\\/i
27+
- string: /SYSTEM\\(ControlSet\d{3}|CurrentControlSet)\\Control\\SystemInformation\\SystemManufacturer/i
2828
- string: /A M I/i
2929
- string: /Hyper-V/i
3030
- string: /Kernel-VMDetection-Private/i

‎nursery/disable-device-guard-features-via-registry-on-windows.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
rule:
2+
meta:
3+
name: disable Device Guard features via registry on Windows
4+
namespace: impact/features
5+
authors:
6+
- mehunhoff@google.com
7+
scopes:
8+
static: function
9+
dynamic: span of calls
10+
att&ck:
11+
- Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001]
12+
mbc:
13+
- Defense Evasion::Disable or Evade Security Tools [F0004]
14+
features:
15+
- and:
16+
- match: set registry value
17+
- or:
18+
- and:
19+
- string: /SYSTEM\\(ControlSet\d{3}|CurrentControlSet)\\Control\\DeviceGuard/i
20+
- or:
21+
- string: /RequirePlatformSecurityFeatures/i
22+
- string: /HVCIMATRequired/i
23+
- string: /RequireSignedBoot/i
24+
- string: /EnableVirtualizationBasedSecurity/i
25+
- and:
26+
- string: /SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard/i
27+
- string: /LsaCfgFlags/i

‎nursery/disable-firewall-features-via-registry-on-windows.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
rule:
2+
meta:
3+
name: disable firewall features via registry on Windows
4+
namespace: impact/features
5+
authors:
6+
- mehunhoff@google.com
7+
scopes:
8+
static: function
9+
dynamic: span of calls
10+
att&ck:
11+
- Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001]
12+
mbc:
13+
- Defense Evasion::Disable or Evade Security Tools [F0004]
14+
features:
15+
- and:
16+
- match: set registry value
17+
- or:
18+
- and:
19+
- or:
20+
- string: /SYSTEM\\(ControlSet\d{3}|CurrentControlSet)\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\PublicProfile/i
21+
- string: /SYSTEM\\(ControlSet\d{3}|CurrentControlSet)\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile/i
22+
- or:
23+
- string: /EnableFirewall/i
24+
- string: /DisableNotifications/i
25+
- and:
26+
- string: /SYSTEM\\(ControlSet\d{3}|CurrentControlSet)\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\DomainProfile/i
27+
- string: /DisableNotifications/i

‎nursery/disable-system-features-via-registry-on-windows.yml‎

Lines changed: 59 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -15,19 +15,62 @@ rule:
1515
- and:
1616
- match: set registry value
1717
- or:
18-
- string: /SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools/i
19-
- string: /SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr/i
20-
- string: /Software\\Policies\\Microsoft\\Windows\\System\\DisableCMD/i
21-
- string: /SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore\\DisableSR/i
22-
- string: /SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFind/i
23-
- string: /SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoDesktop/i
24-
- string: /SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun/i
25-
- string: /SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose/i
26-
- string: /SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoViewContextMenu/i
27-
- string: /SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer/i
28-
- string: /SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\HideClock/i
29-
- string: /SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\NoSizeChoice/i
30-
- string: /SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\NoColorChoice/i
31-
- string: /SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\NoDispBackGroundPage/i
32-
- string: /SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Restrictions\\NoBrowserClose/i
33-
- string: /SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Restrictions\\NoFavorites/i
18+
- and:
19+
- string: /SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System/i
20+
- or:
21+
- string: /DisableRegistryTools/i
22+
- string: /DisableTaskMgr/i
23+
- string: /NoSizeChoice/i
24+
- string: /NoColorChoice/i
25+
- string: /NoDispBackGroundPage/i
26+
- string: /EnableLUA/i
27+
- and:
28+
- string: /Software\\Policies\\Microsoft\\Windows\\System/i
29+
- string: /DisableCMD/i
30+
- and:
31+
- string: /SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer/i
32+
- or:
33+
- string: /NoFind/i
34+
- string: /NoDesktop/i
35+
- string: /NoRun/i
36+
- string: /NoClose/i
37+
- string: /NoViewContextMenu/i
38+
- string: /NoPropertiesMyComputer/i
39+
- string: /HideClock/i
40+
- and:
41+
- string: /SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Restrictions/i
42+
- or:
43+
- string: /NoBrowserClose/i
44+
- string: /NoFavorites/i
45+
- and:
46+
- string: /SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting/i
47+
- string: /Disabled/i
48+
- and:
49+
- string: /SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU/i
50+
- string: /NoAutoUpdate/i
51+
- and:
52+
- or:
53+
- string: /SOFTWARE\\WOW6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon/i
54+
- string: /SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon/i
55+
- string: /SFCDisable/i
56+
- and:
57+
- string: /SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate/i
58+
- string: /DisableWindowsUpdateAccess/i
59+
- and:
60+
- string: /SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Maintenance/i
61+
- string: /MaintenanceDisabled/i
62+
- and:
63+
- string: /SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection/i
64+
- string: /AllowTelemetry/i
65+
- and:
66+
- string: /SYSTEM\\(ControlSet\d{3}|CurrentControlSet)\\Services\\SecurityHealthService/i
67+
- string: /Start/
68+
- and:
69+
- string: /SYSTEM\\(ControlSet\d{3}|CurrentControlSet)\\Services\\EventLog/i
70+
- string: /Start/
71+
- and:
72+
- string: /SYSTEM\\(ControlSet\d{3}|CurrentControlSet)\\Control\\Lsa/i
73+
- string: /LsaCfgFlags/i
74+
- and:
75+
- string: /SYSTEM\\(ControlSet\d{3}|CurrentControlSet)\\Control\\CI\\Config/i
76+
- string: /VulnerableDriverBlocklistEnable/i

‎nursery/disable-system-restore-features-via-registry-on-windows.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
rule:
2+
meta:
3+
name: disable System Restore features via registry on Windows
4+
namespace: impact/features
5+
authors:
6+
- mehunhoff@google.com
7+
scopes:
8+
static: function
9+
dynamic: span of calls
10+
att&ck:
11+
- Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001]
12+
mbc:
13+
- Defense Evasion::Disable or Evade Security Tools [F0004]
14+
features:
15+
- and:
16+
- match: set registry value
17+
- string: /SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore/i
18+
- or:
19+
- string: /DisableSR/i
20+
- string: /DisableConfig/i

‎nursery/disable-windows-defender-features-via-registry-on-windows.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
rule:
2+
meta:
3+
name: disable Windows Defender features via registry on Windows
4+
namespace: impact/features
5+
authors:
6+
- mehunhoff@google.com
7+
scopes:
8+
static: function
9+
dynamic: span of calls
10+
att&ck:
11+
- Defense Evasion::Impair Defenses::Disable or Modify Tools [T1562.001]
12+
mbc:
13+
- Defense Evasion::Disable or Evade Security Tools [F0004]
14+
features:
15+
- and:
16+
- match: set registry value
17+
- or:
18+
- and:
19+
- string: /SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection/i
20+
- or:
21+
- string: /DisableScriptScanning/i
22+
- string: /DisableNetworkProtection/i
23+
- string: /SubmitSamplesConsent/i
24+
- string: /DisableCloudProtection/i
25+
- string: /DisableBlockAtFirstSeen/i
26+
- string: /DisableBehaviorMonitoring/i
27+
- string: /DisableOnAccessProtection/i
28+
- string: /DisableScanOnRealtimeEnable/i
29+
- and:
30+
- string: /SOFTWARE\\Policies\\Microsoft\\Windows Defender/i
31+
- or:
32+
- string: /DisableTamperProtection/i
33+
- string: /DisableSpecialRunningModes/i
34+
- string: /DisableRoutinelyTakingAction/i
35+
- string: /DisableRealtimeMonitoring/i
36+
- string: /DisableIntrusionPreventionSystem/i
37+
- string: /DisableIOAVProtection/i
38+
- string: /DisableCredentialGuard/i
39+
- string: /DisableControlledFolderAccess/i
40+
- string: /DisableApplicationGuard/i
41+
- string: /PUAProtection/i
42+
- string: /ServiceKeepAlive/i
43+
- string: /DisableAntiSpyware/i
44+
- and:
45+
- string: /SOFTWARE\\Policies\\Microsoft\\Windows Defender Security Center\\Notifications/i
46+
- string: /DisableNotifications/i
47+
- and:
48+
- string: /SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Windows Defender Exploit Guard/i
49+
- string: /EnableExploitProtection/i

‎nursery/enumerate-device-drivers-on-windows.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ rule:
1919
- or:
2020
- match: query or enumerate registry key
2121
- match: query or enumerate registry value
22-
- string: /System\\(CurrentControlSet|ControlSet001)\\Services/i
23-
- string: /System\\(CurrentControlSet|ControlSet001)\\Control/i
24-
- string: /System\\(CurrentControlSet|ControlSet001)\\Enum/i
25-
- string: /System\\(CurrentControlSet|ControlSet001)\\HardwareProfiles/i
22+
- string: /System\\(ControlSet\d{3}|CurrentControlSet)\\Services/i
23+
- string: /System\\(ControlSet\d{3}|CurrentControlSet)\\Control/i
24+
- string: /System\\(ControlSet\d{3}|CurrentControlSet)\\Enum/i
25+
- string: /System\\(ControlSet\d{3}|CurrentControlSet)\\HardwareProfiles/i

‎nursery/persist-via-appcertdlls-registry-key.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,4 @@ rule:
1414
features:
1515
- and:
1616
- match: set registry value
17-
- string: /System\\(CurrentControlSet|ControlSet001)\\Control\\Session Manager\\AppCertDlls/i
17+
- string: /System\\(ControlSet\d{3}|CurrentControlSet)\\Control\\Session Manager\\AppCertDlls/i

‎nursery/persist-via-autodialdll-registry-key.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,5 +15,5 @@ rule:
1515
features:
1616
- and:
1717
- match: set registry value
18-
- string: /System\\(CurrentControlSet|ControlSet001)\\Services\\WinSock2\\Parameters/i
18+
- string: /System\\(ControlSet\d{3}|CurrentControlSet)\\Services\\WinSock2\\Parameters/i
1919
- string: /AutodialDLL/i

0 commit comments

Comments
 (0)