Log source category
registry_delete log source Sigma rules
10 Sigma detection rules in the library use the registry_delete log source, mostly on windows. The registry_delete category groups related telemetry so you can find detections that consume the same events. Open a rule to read its detection logic, MITRE ATT&CK mapping and original YAML.
Folder Removed From Exploit Guard ProtectedFolders List - Registry
highDetects the removal of folders from the "ProtectedFolders" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder
windows
Removal Of AMSI Provider Registry Keys
highDetects the deletion of AMSI provider registry key entries in HKLM\Software\Microsoft\AMSI. This technique could be used by an attacker in order to disable AMSI inspection.
windows
RunMRU Registry Key Deletion - Registry
highDetects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog. In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands. Adversaries may delete this key to cover their tracks after executing commands.
windows
Terminal Server Client Connection History Cleared - Registry
highDetects the deletion of registry keys containing the MSTSC connection history
windows
Windows Credential Guard Related Registry Value Deleted - Registry
highDetects attempts to disable Windows Credential Guard by deleting registry values. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation.
windows
Delete Defender Scan ShellEx Context Menu Registry Key
mediumDetects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make it harder for users to scan files that are suspicious.
windows
Removal Of Index Value to Hide Schedule Task - Registry
mediumDetects when the "index" value of a scheduled task is removed or deleted from the registry. Which effectively hides it from any tooling such as "schtasks /query"
windows
Removal of Potential COM Hijacking Registry Keys
mediumDetects any deletion of entries in ".*\shell\open\command" registry keys. These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks.
windows
Removal Of SD Value to Hide Schedule Task - Registry
mediumRemove SD (Security Descriptor) value in \Schedule\TaskCache\Tree registry hive to hide schedule task. This technique is used by Tarrask malware
windows
Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted
mediumDetects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
windows