Windows Registry: Enable ScriptedDiagnostics TurnOffCheck DWORD via Policies

Flags registry policy enabling ScriptedDiagnostics TurnOffCheck (DWORD 0x00000001) on Windows.

FreeUnreviewedSigmamediumv1

windows-registry-enable-scripteddiagnostics-turnoffcheck-dword-via-policies-7d995e63

title: "Windows Registry: Enable ScriptedDiagnostics TurnOffCheck DWORD via Policies"
id: f844a773-d007-4798-ac3b-c15d482a52ab
status: test
description: This rule identifies changes to a Windows registry policy that set the ScriptedDiagnostics TurnOffCheck value to DWORD 0x00000001. Attackers may use this setting to disable a diagnostic check that can weaken defensive behaviors. It relies on registry set telemetry matching the targeted Policies\Microsoft\Windows\ScriptedDiagnostics\TurnOffCheck key and the specific DWORD data.
references:
  - https://twitter.com/wdormann/status/1537075968568877057?s=20&t=0lr18OAnmAGoGpma6grLUw
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_enabling_turnoffcheck.yml
author: Christopher Peacock @securepeacock, SCYTHE @scythe_io, Huntrule Team
date: 2022-06-15
modified: 2023-08-17
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|endswith: \Policies\Microsoft\Windows\ScriptedDiagnostics\TurnOffCheck
    Details: DWORD (0x00000001)
  condition: selection
falsepositives:
  - Administrator actions
level: medium
license: DRL-1.1
related:
  - id: 7d995e63-ec83-4aa3-89d5-8a17b5c87c86
    type: derived

What it detects

This rule identifies changes to a Windows registry policy that set the ScriptedDiagnostics TurnOffCheck value to DWORD 0x00000001. Attackers may use this setting to disable a diagnostic check that can weaken defensive behaviors. It relies on registry set telemetry matching the targeted Policies\Microsoft\Windows\ScriptedDiagnostics\TurnOffCheck key and the specific DWORD data.

Known false positives

Administrator actions

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.