Suspicious Old TLS1.0/TLS1.1 Protocol Version Enabled (via registry_set)

title: Suspicious Old TLS1.0/TLS1.1 Protocol Version Enabled (via registry_set)
id: a5e09ad0-48e2-5b15-868c-811cf7f36720
status: stable
description: This rule detects applications or users re-enabling old TLS versions by setting the "Enabled" value to "1" for the "Protocols" registry key.
references:
    - https://techcommunity.microsoft.com/t5/windows-it-pro-blog/tls-1-0-and-tls-1-1-soon-to-be-disabled-in-windows/ba-p/3887947
author: Huntrule Team
date: 2026-03-29
tags:
    - attack.stealth
    - attack.defense-evasion
    - attack.t1562.001
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains:
            - '\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\'
            - '\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\'
        TargetObject|endswith: '\Enabled'
        Details: 'DWORD (0x00000001)'
    condition: selection
falsepositives:
    - Unknown
level: medium