Windows Registry Key Change Disabling System Restore

title: Windows Registry Key Change Disabling System Restore
id: e985a671-6711-473e-840c-87a4b9080b1b
related:
  - id: 7c06ab9b-b1d2-4ba9-b06e-09491ded20d9
    type: similar
  - id: 5de03871-5d46-4539-a82d-3aa992a69a83
    type: derived
status: test
description: This rule flags Windows registry modifications that set the System Restore policy configuration to disable it. Disabling recovery functionality can help an attacker reduce recovery options and hinder incident response. It relies on registry set telemetry, matching specific TargetObject paths ending in DisableConfig or DisableSR with a DWORD value of 0x00000001.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-9---disable-system-restore-through-registry
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_system_restore.yml
author: frack113, Huntrule Team
date: 2022-04-04
modified: 2023-08-17
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - \Policies\Microsoft\Windows NT\SystemRestore
      - \Microsoft\Windows NT\CurrentVersion\SystemRestore
    TargetObject|endswith:
      - DisableConfig
      - DisableSR
    Details: DWORD (0x00000001)
  condition: selection
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_system_restore/info.yml
simulation:
  - type: atomic-red-team
    name: Disable System Restore Through Registry
    technique: T1490
    atomic_guid: 66e647d1-8741-4e43-b7c1-334760c2047f
license: DRL-1.1