Windows Vulnerable Driver Blocklist Disabled via Registry DWORD Setting

title: Windows Vulnerable Driver Blocklist Disabled via Registry DWORD Setting
id: b2ab7dc1-ae29-4164-8158-f7aa3895a5c9
related:
  - id: 22154f0e-5132-4a54-aa78-cc62f6def531
    type: similar
  - id: d526c60a-e236-4011-b165-831ffa52ab70
    type: derived
status: experimental
description: This rule identifies changes that disable the Windows Vulnerable Driver Blocklist by setting the DWORD value at \Control\CI\Config\VulnerableDriverBlocklistEnable to 0x00000000. Disabling the blocklist matters because it reduces protections against known vulnerable drivers and can enable subsequent driver-based attacks or abuse of weakened driver controls. The detection relies on registry set telemetry capturing the target registry path and the specific DWORD value written.
references:
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules
  - https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_vulnerable_driver_blocklist_disable.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-01-26
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: \Control\CI\Config\VulnerableDriverBlocklistEnable
    Details: DWORD (0x00000000)
  condition: selection
falsepositives:
  - Unlikely and should be investigated immediately.
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_vulnerable_driver_blocklist_disable/info.yml
license: DRL-1.1