Windows Registry: Disable Privacy Settings Experience via DisablePrivacyExperience Policy

Flags Windows registry policy changes that disable the Privacy Settings Experience by setting DisablePrivacyExperience to 0x00000000.

FreeUnreviewedSigmamediumv1

windows-registry-disable-privacy-settings-experience-via-disableprivacyexperienc-0372e1f9

title: "Windows Registry: Disable Privacy Settings Experience via DisablePrivacyExperience Policy"
id: ccb8b43f-f461-477c-be63-144e5fc57631
status: test
description: This rule identifies modifications to the Windows policy registry key that sets DisablePrivacyExperience to a DWORD value of 0x00000000. Disabling the Privacy Settings Experience can be used for defense evasion or to impair user visibility into privacy controls. Telemetry relies on registry_set events that capture the target registry path and the written value details.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1562.001/T1562.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_privacy_settings_experience.yml
author: frack113, Huntrule Team
date: 2022-10-02
modified: 2023-08-17
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: \SOFTWARE\Policies\Microsoft\Windows\OOBE\DisablePrivacyExperience
    Details: DWORD (0x00000000)
  condition: selection
falsepositives:
  - Legitimate admin script
level: medium
license: DRL-1.1
related:
  - id: 0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b
    type: derived

What it detects

This rule identifies modifications to the Windows policy registry key that sets DisablePrivacyExperience to a DWORD value of 0x00000000. Disabling the Privacy Settings Experience can be used for defense evasion or to impair user visibility into privacy controls. Telemetry relies on registry_set events that capture the target registry path and the written value details.

Known false positives

Legitimate admin script

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.