Windows Registry: EnablePeriodicBackup value set for periodic system hive backups

Alerts on enabling the Windows registry setting that triggers periodic system hive backups to RegBack on restarts.

FreeUnreviewedSigmamediumv1

windows-registry-enableperiodicbackup-value-set-for-periodic-system-hive-backups-973ef012

title: "Windows Registry: EnablePeriodicBackup value set for periodic system hive backups"
id: 50f4ea0f-daed-4602-92c0-a47ef1f528df
status: test
description: This rule detects when the registry value EnablePeriodicBackup is enabled under Control\Session Manager\Configuration Manager, setting it to DWORD 0x00000001. When enabled, Windows can back up system registry hives on restarts into C:\Windows\System32\config\RegBack and manages follow-on backups via the RegIdleBackup scheduled task. Attackers may leverage this to capture registry state over time, so registry write telemetry is critical for monitoring changes to this setting.
references:
  - https://learn.microsoft.com/en-us/troubleshoot/windows-client/installing-updates-features-roles/system-registry-no-backed-up-regback-folder
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_enable_periodic_backup.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-07-01
tags:
  - attack.collection
  - attack.t1113
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: \Control\Session Manager\Configuration Manager\EnablePeriodicBackup
    Details: DWORD (0x00000001)
  condition: selection
falsepositives:
  - Legitimate need for RegBack feature by administrators.
level: medium
license: DRL-1.1
related:
  - id: 973ef012-8f1a-4c40-93b4-7e659a5cd17f
    type: derived

What it detects

This rule detects when the registry value EnablePeriodicBackup is enabled under Control\Session Manager\Configuration Manager, setting it to DWORD 0x00000001. When enabled, Windows can back up system registry hives on restarts into C:\Windows\System32\config\RegBack and manages follow-on backups via the RegIdleBackup scheduled task. Attackers may leverage this to capture registry state over time, so registry write telemetry is critical for monitoring changes to this setting.

Known false positives

Legitimate need for RegBack feature by administrators.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.