Attempt to Disable Windows Driver Blocklist via Registry

[rule]
description = """
Identifies registry modifications to disable Microsoft policy that prevents a blacklist of known vulnerable drivers.
This could be indicative of adversary defense evasion by attempting to load and exploit a vulnerable driver.
"""
id = "31b7218e-ba98-4228-a39a-d0e0d1c0e5b7"
license = "Elastic License v2"
name = "Attempt to Disable Windows Driver Blocklist via Registry"
os_list = ["windows"]
reference = [
    "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules",
    "https://www.unknowncheats.me/forum/anti-cheat-bypass/524561-windows-11-blacklisteddrivers-fix.html",
]
version = "1.0.18"

query = '''
registry where registry.path : "HKLM\\SYSTEM\\*ControlSet*\\CI\\Config\\VulnerableDriverBlocklistEnable" and
 registry.data.strings : "0" and
 not process.executable : ("?:\\Windows\\System32\\SecurityHealthService.exe",
                           "C:\\Program Files (x86)\\Common Files\\InstallShield\\engine\\?\\Intel 32\\IKernel.exe")
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1112"
name = "Modify Registry"
reference = "https://attack.mitre.org/techniques/T1112/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"