Windows Vulnerable Driver Blocklist Disabled via Registry DWORD Setting
Flags registry changes that disable Windows Vulnerable Driver Blocklist (VulnerableDriverBlocklistEnable = 0).
- Product
- windows
- Category
- registry_set
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2026-01-26
- Updated
- 2026-07-30
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies changes that disable the Windows Vulnerable Driver Blocklist by setting the DWORD value at \Control\CI\Config\VulnerableDriverBlocklistEnable to 0x00000000. Disabling the blocklist matters because it reduces protections against known vulnerable drivers and can enable subsequent driver-based attacks or abuse of weakened driver controls. The detection relies on registry set telemetry capturing the target registry path and the specific DWORD value written.
Reporting behind it
- docs.microsoft.comhttps://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules
- sophos.comhttps://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_vulnerable_driver_blocklist_disable.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Vulnerable Driver Blocklist Disabled via Registry DWORD Setting
id: b2ab7dc1-ae29-4164-8158-f7aa3895a5c9
related:
- id: 22154f0e-5132-4a54-aa78-cc62f6def531
type: similar
- id: d526c60a-e236-4011-b165-831ffa52ab70
type: derived
status: experimental
description: This rule identifies changes that disable the Windows Vulnerable Driver Blocklist by setting the DWORD value at \Control\CI\Config\VulnerableDriverBlocklistEnable to 0x00000000. Disabling the blocklist matters because it reduces protections against known vulnerable drivers and can enable subsequent driver-based attacks or abuse of weakened driver controls. The detection relies on registry set telemetry capturing the target registry path and the specific DWORD value written.
references:
- https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules
- https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_vulnerable_driver_blocklist_disable.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-01-26
tags:
- attack.defense-impairment
- attack.t1685
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|endswith: \Control\CI\Config\VulnerableDriverBlocklistEnable
Details: DWORD (0x00000000)
condition: selection
falsepositives:
- Unlikely and should be investigated immediately.
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_vulnerable_driver_blocklist_disable/info.yml
license: DRL-1.1