Detection rules › Sigma
Old TLS1.0/TLS1.1 Protocol Version Enabled
Detects applications or users re-enabling old TLS versions by setting the "Enabled" value to "1" for the "Protocols" registry key.
Known false positives
- Legitimate enabling of the old tls versions due to incompatibility
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | No specific technique |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 13: RegistryEvent (Value Set) |
Rule body
title: Old TLS1.0/TLS1.1 Protocol Version Enabled
id: 439957a7-ad86-4a8f-9705-a28131c6821b
status: test
description: Detects applications or users re-enabling old TLS versions by setting the "Enabled" value to "1" for the "Protocols" registry key.
references:
- https://techcommunity.microsoft.com/t5/windows-it-pro-blog/tls-1-0-and-tls-1-1-soon-to-be-disabled-in-windows/ba-p/3887947
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-09-05
tags:
- attack.stealth
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains:
- '\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\'
- '\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\'
TargetObject|endswith: '\Enabled'
Details: 'DWORD (0x00000001)'
condition: selection
falsepositives:
- Legitimate enabling of the old tls versions due to incompatibility
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
TargetObject|contains:
- '\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\'
- '\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\'
TargetObject|endswith: '\Enabled'
Details: 'DWORD (0x00000001)'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Details | eq |
| field:"Details" kind:eq value:"DWORD (0x00000001)" |
TargetObject | ends_with |
| field:"TargetObject" kind:ends_with value:"\Enabled" |
TargetObject | match |
| field:"TargetObject" kind:match |