Windows: Process writes registry to disable storage write-protection

title: "Windows: Process writes registry to disable storage write-protection"
id: 825816fe-6513-435d-ac4f-d7ed0be14752
status: test
description: This rule flags process executions whose command line contains registry path and value fragments associated with disabling storage write-protection. Attackers may attempt to weaken storage safeguards to enable later destructive or extortion-related activity. The detection relies on Windows process creation telemetry and matches specific command-line substrings related to the relevant registry location and settings.
references:
  - https://www.manageengine.com/products/desktop-central/os-imaging-deployment/media-is-write-protected.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_write_protect_for_storage_disabled.yml
author: Sreeman, Huntrule Team
date: 2021-06-11
modified: 2024-01-18
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains|all:
      - \System\CurrentControlSet\Control
      - Write Protection
      - "0"
      - storage
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13
    type: derived