Windows Registry Ransom Note Keyword Changes in LegalNoticeCaption/Text
Alerts on registry changes to Windows legal notice caption/text containing ransomware-style keywords.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-12-11
- Updated
- 2026-07-30
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule flags modifications to the Windows “LegalNoticeCaption” and “LegalNoticeText” registry values when the new message contains ransomware-associated keywords such as “encrypted,” “Unlock-Password,” or “paying.” Attackers may use these text fields to display ransom-style instructions to users immediately upon login or session access. The detection relies on Windows registry set telemetry capturing the target value path and the updated content.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Ransom Note Keyword Changes in LegalNoticeCaption/Text
id: 1773711c-076e-4aae-bd58-bd7167ebd887
status: test
description: This rule flags modifications to the Windows “LegalNoticeCaption” and “LegalNoticeText” registry values when the new message contains ransomware-associated keywords such as “encrypted,” “Unlock-Password,” or “paying.” Attackers may use these text fields to display ransom-style instructions to users immediately upon login or session access. The detection relies on Windows registry set telemetry capturing the target value path and the updated content.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1491.001/T1491.001.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_legalnotice_susp_message.yml
author: frack113, Huntrule Team
date: 2022-12-11
modified: 2023-08-17
tags:
- attack.impact
- attack.t1491.001
logsource:
product: windows
category: registry_set
detection:
selection:
TargetObject|contains:
- \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaption
- \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeText
Details|contains:
- encrypted
- Unlock-Password
- paying
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 8b9606c9-28be-4a38-b146-0e313cc232c1
type: derived