Windows Registry: Enabled TLS 1.0 or TLS 1.1 via SCHANNEL Protocols Enabled=1

title: "Windows Registry: Enabled TLS 1.0 or TLS 1.1 via SCHANNEL Protocols Enabled=1"
id: af7c871d-6116-485d-862b-0047bb00fb13
status: test
description: This rule catches changes to the Windows SCHANNEL registry settings where TLS 1.0 or TLS 1.1 is re-enabled by setting the Protocols\TLS 1.0\Enabled or Protocols\TLS 1.1\Enabled value to DWORD 0x00000001. Re-enabling older TLS versions can weaken transport security and increase exposure to downgrade or legacy cryptographic weaknesses. The detection relies on registry set telemetry for writes to the specific TargetObject paths and the Enabled value.
references:
  - https://techcommunity.microsoft.com/t5/windows-it-pro-blog/tls-1-0-and-tls-1-1-soon-to-be-disabled-in-windows/ba-p/3887947
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_tls_protocol_old_version_enabled.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-09-05
tags:
  - attack.stealth
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - \Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\
      - \Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\
    TargetObject|endswith: \Enabled
    Details: DWORD (0x00000001)
  condition: selection
falsepositives:
  - Legitimate enabling of the old tls versions due to incompatibility
level: medium
license: DRL-1.1
related:
  - id: 439957a7-ad86-4a8f-9705-a28131c6821b
    type: derived