huntrule

Suspicious Scripted Diagnostics Turn Off Check Enabled - Registry (via registry_set)

This rule detects enabling TurnOffCheck that can be leveraged to bypass defense of MSDT Follina vulnerability

SigmamediumWindowsv1
sigma
title: Suspicious Scripted Diagnostics Turn Off Check Enabled - Registry (via registry_set)
id: 3f8fcd6d-d0eb-5f39-97fc-428e335b4489
status: stable
description: This rule detects enabling TurnOffCheck that can be leveraged to bypass defense of MSDT Follina vulnerability
references:
    - https://attack.mitre.org/techniques/T1685/
    - https://twitter.com/wdormann/status/1537075968568877057?s=20&t=0lr18OAnmAGoGpma6grLUw
author: 'Huntrule Team'
date: 2026-07-26
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|endswith: '\Policies\Microsoft\Windows\ScriptedDiagnostics\TurnOffCheck'
        Details: 'DWORD (0x00000001)'
    condition: selection
falsepositives:
    - Unknown
level: medium

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.