Windows Registry: Enabled TLS 1.0 or TLS 1.1 via SCHANNEL Protocols Enabled=1
Flags registry changes that set SCHANNEL TLS 1.0/1.1 Enabled to 1 on Windows.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-09-05
- Updated
- 2026-07-30
What it detects
This rule catches changes to the Windows SCHANNEL registry settings where TLS 1.0 or TLS 1.1 is re-enabled by setting the Protocols\TLS 1.0\Enabled or Protocols\TLS 1.1\Enabled value to DWORD 0x00000001. Re-enabling older TLS versions can weaken transport security and increase exposure to downgrade or legacy cryptographic weaknesses. The detection relies on registry set telemetry for writes to the specific TargetObject paths and the Enabled value.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-enabled-tls-1-0-or-tls-1-1-via-schannel-protocols-enabled-1-439957a7
title: "Windows Registry: Enabled TLS 1.0 or TLS 1.1 via SCHANNEL Protocols Enabled=1"
id: af7c871d-6116-485d-862b-0047bb00fb13
status: test
description: This rule catches changes to the Windows SCHANNEL registry settings where TLS 1.0 or TLS 1.1 is re-enabled by setting the Protocols\TLS 1.0\Enabled or Protocols\TLS 1.1\Enabled value to DWORD 0x00000001. Re-enabling older TLS versions can weaken transport security and increase exposure to downgrade or legacy cryptographic weaknesses. The detection relies on registry set telemetry for writes to the specific TargetObject paths and the Enabled value.
references:
- https://techcommunity.microsoft.com/t5/windows-it-pro-blog/tls-1-0-and-tls-1-1-soon-to-be-disabled-in-windows/ba-p/3887947
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_tls_protocol_old_version_enabled.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-09-05
tags:
- attack.stealth
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains:
- \Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\
- \Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\
TargetObject|endswith: \Enabled
Details: DWORD (0x00000001)
condition: selection
falsepositives:
- Legitimate enabling of the old tls versions due to incompatibility
level: medium
license: DRL-1.1
related:
- id: 439957a7-ad86-4a8f-9705-a28131c6821b
type: derived