Windows Registry Ransom Note Keyword Changes in LegalNoticeCaption/Text

Alerts on registry changes to Windows legal notice caption/text containing ransomware-style keywords.

FreeUnreviewedSigmahighv1

windows-registry-ransom-note-keyword-changes-in-legalnoticecaption-text-8b9606c9

title: Windows Registry Ransom Note Keyword Changes in LegalNoticeCaption/Text
id: 1773711c-076e-4aae-bd58-bd7167ebd887
status: test
description: This rule flags modifications to the Windows “LegalNoticeCaption” and “LegalNoticeText” registry values when the new message contains ransomware-associated keywords such as “encrypted,” “Unlock-Password,” or “paying.” Attackers may use these text fields to display ransom-style instructions to users immediately upon login or session access. The detection relies on Windows registry set telemetry capturing the target value path and the updated content.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1491.001/T1491.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_legalnotice_susp_message.yml
author: frack113, Huntrule Team
date: 2022-12-11
modified: 2023-08-17
tags:
  - attack.impact
  - attack.t1491.001
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains:
      - \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaption
      - \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeText
    Details|contains:
      - encrypted
      - Unlock-Password
      - paying
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 8b9606c9-28be-4a38-b146-0e313cc232c1
    type: derived

What it detects

This rule flags modifications to the Windows “LegalNoticeCaption” and “LegalNoticeText” registry values when the new message contains ransomware-associated keywords such as “encrypted,” “Unlock-Password,” or “paying.” Attackers may use these text fields to display ransom-style instructions to users immediately upon login or session access. The detection relies on Windows registry set telemetry capturing the target value path and the updated content.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.