Windows Registry

This tree combines registry paths selected from detection rules with a Windows 11 22H2 hive inventory. An inferred path points to a possible key or value. An inferred branch points to a parent key because the rule leaves the exact key or value unresolved.

HKLM #
- HKLM\COMPONENTS\PendingXmlIdentifier#
  
  Windows Downdate Registry Activity Splunk (inferred path)
- HKLM\HARDWARE#
  - HKLM\HARDWARE\{2DB80286-1784-48b5-A751-B6ED1F490303}#
  - HKLM\HARDWARE\{804423C2-F490-4ac3-BFA5-13DEDE63A71A}#
  - HKLM\HARDWARE\{A5124AF5-DF23-49bf-B0ED-A18ED3DEA027}#
    
    FlowCloud Registry Markers Sigma (inferred path)
- HKLM\SAM#
  
  Suspicious Registry Hive Dump Elastic (inferred path)
  - HKLM\SAM\SAM\Domains#
    
    Backdoor introduction via registry permission change through WMI (DAMP) Sigma
    - HKLM\SAM\SAM\Domains\Account#
      
      Security Account Manager (SAM) Registry Access Elastic (inferred path)
      Remote Access to Sensitive Registry Keys Elastic (inferred path)
      - HKLM\SAM\SAM\Domains\Account\Users#
        
        HKLM\SAM\SAM\Domains\Account\Users\Names#
        
        Creation of a Hidden Local User Account Elastic (inferred branch)
        HKLM\SAM\SAM\Domains\Account\Users\Names#
        
        Creation of a Local Hidden User Account by Registry Sigma (inferred path)
- HKLM\SAM#
  
  SAM Registry Hive Handle Request Sigma (inferred path)
- HKLM\SECURITY#
  
  Suspicious Registry Hive Dump Elastic (inferred path)
  Backdoor introduction via registry permission change through WMI (DAMP) Sigma
  - HKLM\SECURITY\Cache#
    
    Suspicious Access to LSA Secrets Registry Elastic (inferred path)
    Remote Access to Sensitive Registry Keys Elastic (inferred path)
  - HKLM\SECURITY\Policy#
    
    Backdoor introduction via registry permission change through WMI (DAMP) Sigma
    - HKLM\SECURITY\Policy\Secrets#
      
      Suspicious Registry Hive Dump Elastic (inferred path)
      Suspicious Access to LSA Secrets Registry Elastic (inferred path)
      Remote Access to Sensitive Registry Keys Elastic (inferred path)
      - HKLM\SECURITY\Policy\Secrets\n#
        
        SNAKE Malware Covert Store Registry Key Sigma (inferred path)
- HKLM\SOFTWARE#
  
  Windows Modify Registry With MD5 Reg Key Name Splunk (inferred path)
  Stored data is Binary Data
  - HKLM\SOFTWARE\App#
    
    OceanLotus Registry Activity Sigma (inferred path)
  - HKLM\Software\AppDataLow\Software\Microsoft\3A861D62-51E0-7C9D-AB0E-15700F2219A4#
    
    Potential Ursnif Malware Activity - Registry Sigma (inferred path)
  - HKLM\SOFTWARE\Classes#
    
    Shell Context Menu Command Tampering Sigma (inferred path)
    New File Association Using Exefile Sigma (inferred path)
    Stored data is exefile
    Bypass UAC Using DelegateExecute Sigma (inferred path)
    Stored data is (Empty)
    Removal of Potential COM Hijacking Registry Keys Sigma (inferred path)
    Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace Sigma (inferred path)
    Windows Installer with Suspicious Properties Elastic (inferred path)
    Suspicious Shell Open Command Registry Modification Sigma (inferred path)
    Custom File Open Handler Executes PowerShell Sigma (inferred path)
    - HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP#Literal key
      
      Windows Impair Defense Delete Win Defender Context Menu Splunk (inferred path)
      Delete Defender Scan ShellEx Context Menu Registry Key Sigma (inferred path)
    - HKLM\SOFTWARE\Classes\.cmd#
      
      Classes Autorun Keys Modification Sigma (inferred path)
    - HKLM\SOFTWARE\Classes\.exe#
      
      Classes Autorun Keys Modification Sigma (inferred path)
    - HKLM\SOFTWARE\Classes\.wav\OpenWithProgIds#
      
      Potential Encrypted Registry Blob Related To SNAKE Malware Sigma (inferred branch)
      - HKLM\SOFTWARE\Classes\.wav\OpenWithProgIds\WMP11.AssocFile.WAV#value
        
        Windows Snake Malware Registry Modification wav OpenWithProgIds Splunk (inferred path)
    - HKLM\SOFTWARE\Classes\AppID#
      
      Suspicious Remote Registry Modification Elastic (inferred path)
      Potential RemoteMonologue Attack Elastic (inferred path)
    - HKLM\SOFTWARE\Classes\CLSID#
      
      COM Registry Key Modified to Point to File in Color Profile Folder Kusto (inferred path)
      Windows New InProcServer32 Added Splunk (inferred path)
      Register New IFiltre For Persistence Sigma (inferred branch)
      COM Object Hijacking Via Modification Of Default System CLSID Default Value Sigma (inferred path)
      Registry Run Keys - Suspicious Registry Run Keys Kusto (inferred path)
      Potential Persistence Via Scrobj.dll COM Hijacking Sigma (inferred path)
      Stored data is C:\WINDOWS\system32\scrobj.dll
      Removal Of AMSI Provider Registry Keys Sigma (inferred path)
      COM Hijacking via TreatAs Sigma (inferred path)
      Component Object Model Hijacking - Vault7 trick Kusto (inferred path)
      Windows InProcServer32 New Outlook Form Splunk (inferred path)
      Stored data is *\\FORMS\\*
      Suspicious Remote Registry Modification Elastic (inferred path)
      Component Object Model Hijacking Elastic (inferred path)
      Classes Autorun Keys Modification Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\CLSID\{0b91a74b-ad7c-4a9d-b563-29eef9167172}\InprocServer32#
        
        HKLM\SOFTWARE\Classes\CLSID\{0b91a74b-ad7c-4a9d-b563-29eef9167172}\InprocServer32\(Default)#value
        
        COM Object Hijacking Via Modification Of Default System CLSID Default Value Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32#
        
        HKLM\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32\(Default)#value
        
        COM Object Hijacking Via Modification Of Default System CLSID Default Value Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\CLSID\{2DEA658F-54C1-4227-AF9B-260AB5FC3543}\InprocServer32#
        
        HKLM\SOFTWARE\Classes\CLSID\{2DEA658F-54C1-4227-AF9B-260AB5FC3543}\InprocServer32\(Default)#value
        
        COM Object Hijacking Via Modification Of Default System CLSID Default Value Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\CLSID\{4DE225BF-CF59-4CFC-85F7-68B90F185355}\InprocServer32#
        
        HKLM\SOFTWARE\Classes\CLSID\{4DE225BF-CF59-4CFC-85F7-68B90F185355}\InprocServer32\(Default)#value
        
        COM Object Hijacking Via Modification Of Default System CLSID Default Value Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32#
        
        HKLM\SOFTWARE\Classes\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\(Default)#value
        
        CVE-2021-31979 CVE-2021-33771 Exploits Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}#
        
        Suspicious Execution via ShellBrowserWindow/ShellWindow COM Elastic (inferred path)
        
        HKLM\SOFTWARE\Classes\CLSID\{9BA05972-F6A8-11CF-A442-00A0C90A8F39}\LocalServer32#
        
        Suspicious Execution via ShellBrowserWindow/ShellWindow COM Elastic (inferred path)
      - HKLM\SOFTWARE\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\TreatAs#
        
        COM to .NET Redirection via Registry Elastic (inferred branch)
        Stored data is {81C5FE01-027C-3E1C-98D5-DA9C9862AA21}
      - HKLM\SOFTWARE\Classes\CLSID\{026CC6D7-34B2-33D5-B551-CA31EB6CE345}#
        
        Forest Blizzard APT - Custom Protocol Handler DLL Registry Set Sigma (inferred branch)
      - HKLM\SOFTWARE\Classes\CLSID\{30d49246-d217-465f-b00b-ac9ddd652eb7}\InProcServer32#
        
        HKLM\SOFTWARE\Classes\CLSID\{30d49246-d217-465f-b00b-ac9ddd652eb7}\InProcServer32\(Default)#value
        
        COM Object Hijacking Via Modification Of Default System CLSID Default Value Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\CLSID\{52A2AAAE-085D-4187-97EA-8C30DB990436}\InprocServer32#
        
        HKLM\SOFTWARE\Classes\CLSID\{52A2AAAE-085D-4187-97EA-8C30DB990436}\InprocServer32\(Default)#value
        
        Persistence Via Hhctrl.ocx Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\InProcServer32#
        
        HKLM\SOFTWARE\Classes\CLSID\{603D3801-BD81-11d0-A3A5-00C04FD706EC}\InProcServer32\(Default)#value
        
        COM Object Hijacking Via Modification Of Default System CLSID Default Value Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\CLSID\{0003000C-0000-0000-C000-000000000046}\TreatAs#
        
        COM to .NET Redirection via Registry Elastic (inferred branch)
        Stored data is {81C5FE01-027C-3E1C-98D5-DA9C9862AA21}
      - HKLM\SOFTWARE\Classes\CLSID\{0003000D-0000-0000-C000-000000000046}\TreatAs#
        
        COM to .NET Redirection via Registry Elastic (inferred branch)
        Stored data is {81C5FE01-027C-3E1C-98D5-DA9C9862AA21}
      - HKLM\SOFTWARE\Classes\CLSID\{0003000E-0000-0000-C000-000000000046}\TreatAs#
        
        COM to .NET Redirection via Registry Elastic (inferred branch)
        Stored data is {81C5FE01-027C-3E1C-98D5-DA9C9862AA21}
      - HKLM\SOFTWARE\Classes\CLSID\{00022601-0000-0000-C000-000000000046}\TreatAs#
        
        COM to .NET Redirection via Registry Elastic (inferred branch)
        Stored data is {81C5FE01-027C-3E1C-98D5-DA9C9862AA21}
      - HKLM\SOFTWARE\Classes\CLSID\{00022602-0000-0000-C000-000000000046}\TreatAs#
        
        COM to .NET Redirection via Registry Elastic (inferred branch)
        Stored data is {81C5FE01-027C-3E1C-98D5-DA9C9862AA21}
      - HKLM\SOFTWARE\Classes\CLSID\{00022603-0000-0000-C000-000000000046}\TreatAs#
        
        COM to .NET Redirection via Registry Elastic (inferred branch)
        Stored data is {81C5FE01-027C-3E1C-98D5-DA9C9862AA21}
      - HKLM\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32#
        
        Common Autorun Keys Modification Sigma (inferred path)
        
        HKLM\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\(Default)#value
        
        Common Autorun Keys Modification Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\CLSID\{c08afd90-f2a1-11d1-8455-00a0c91f3880}#
        
        Suspicious Execution via ShellBrowserWindow/ShellWindow COM Elastic (inferred path)
        
        HKLM\SOFTWARE\Classes\CLSID\{c08afd90-f2a1-11d1-8455-00a0c91f3880}\LocalServer32#
        
        Suspicious Execution via ShellBrowserWindow/ShellWindow COM Elastic (inferred path)
      - HKLM\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InProcServer32#
        
        HKLM\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InProcServer32\(Default)#value
        
        Potential PSFactoryBuffer COM Hijacking Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32#
        
        HKLM\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32\(Default)#value
        
        CVE-2021-31979 CVE-2021-33771 Exploits Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\CLSID\{f744e496-1b5a-489e-81dc-fbd7ac6298a8}\TreatAs#
        
        COM to .NET Redirection via Registry Elastic (inferred branch)
        Stored data is {81C5FE01-027C-3E1C-98D5-DA9C9862AA21}
      - HKLM\SOFTWARE\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InprocServer32#
        
        HKLM\SOFTWARE\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InprocServer32\(Default)#value
        
        Potential AMSI COM Server Hijacking Sigma (inferred path)
    - HKLM\SOFTWARE\Classes\Directory\shellex#
      - HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP#
        
        Windows Impair Defense Delete Win Defender Context Menu Splunk (inferred path)
        Delete Defender Scan ShellEx Context Menu Registry Key Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\Directory\shellex\CopyHookHandlers#
        
        Classes Autorun Keys Modification Sigma (inferred path)
    - HKLM\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP#
      
      Windows Impair Defense Delete Win Defender Context Menu Splunk (inferred path)
      Delete Defender Scan ShellEx Context Menu Registry Key Sigma (inferred path)
    - HKLM\SOFTWARE\Classes\exefile\shell#
      - HKLM\SOFTWARE\Classes\exefile\shell\open\command#
        
        Startup Persistence by a Low Reputation Process Elastic (inferred path)
        Classes Autorun Keys Modification Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\exefile\shell\runas\command#
        
        HKLM\SOFTWARE\Classes\exefile\shell\runas\command\(Default)#value
        
        Sdclt UAC Bypass Splunk (inferred path)
        HKLM\SOFTWARE\Classes\exefile\shell\runas\command\IsolatedCommand#value
        
        UAC Bypass via Sdclt Sigma (inferred path)
        Sdclt UAC Bypass Splunk (inferred path)
    - HKLM\SOFTWARE\Classes\Folder#
      - HKLM\SOFTWARE\Classes\Folder\shell\open\command#
        
        UAC Bypass via Sdclt Sigma (inferred branch)
        
        HKLM\SOFTWARE\Classes\Folder\shell\open\command\DelegateExecute#value
        
        COM Hijack via Sdclt Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\Folder\ShellEx\DragDropHandlers#
        
        Classes Autorun Keys Modification Sigma (inferred path)
    - HKLM\SOFTWARE\Classes\htmlfile\shell\open\command#
      
      Registry Keys Used For Persistence Splunk (inferred path)
      Common Autorun Keys Modification Sigma (inferred path)
    - HKLM\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers\Console#
      
      Windows Modify Registry ValleyRAT C2 Config Splunk (inferred branch)
    - HKLM\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows#
      
      Windows Modify Registry Qakbot Binary Data Registry Splunk (inferred path)
      - HKLM\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion#
        
        VBScript Payload Stored in Registry Sigma (inferred path)
        
        HKLM\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository#
        
        UAC Bypass via WSReset Execution Hijack Elastic (inferred path)
    - HKLM\SOFTWARE\Classes\ms-settings#
      
      Windows Modify Registry Utilize ProgIDs Splunk (inferred branch)
      - HKLM\SOFTWARE\Classes\ms-settings\Shell\Open\Command#
        
        Potential Fodhelper UAC Bypass (ASIM Version) Kusto (inferred path)
        Potential Fodhelper UAC Bypass Kusto (inferred path)
    - HKLM\SOFTWARE\Classes\mscfile\shell\open\command#
      
      UAC Bypass via Event Viewer Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\mscfile\shell\open\command\(Default)#value
        
        Eventvwr UAC Bypass Splunk (inferred path)
    - HKLM\SOFTWARE\Classes\PROTOCOLS\Handler#
      
      Common Autorun Keys Modification Sigma (inferred path)
      Forest Blizzard APT - Custom Protocol Handler Creation Sigma (inferred branch)
      Stored data is {026CC6D7-34B2-33D5-B551-CA31EB6CE345}
    - HKLM\SOFTWARE\Classes\SOFTWARE\Microsoft\Internet Explorer#
      
      Windows Modify Registry Qakbot Binary Data Registry Splunk (inferred path)
    - HKLM\SOFTWARE\Classes\SystemFileAssociations\.exe#
      
      Classes Autorun Keys Modification Sigma (inferred path)
    - HKLM\SOFTWARE\Classes\TypeLib\{3ff1aab8-f3d8-11d4-825d-00104b3646c0}\1.0#
      
      WaaSMedicSvc COM Type Lib Hijack Elastic (inferred branch)
    - HKLM\SOFTWARE\Classes\WOW6432Node\CLSID#
      
      COM Registry Key Modified to Point to File in Color Profile Folder Kusto (inferred path)
      Windows New InProcServer32 Added Splunk (inferred path)
      Component Object Model Hijacking - Vault7 trick Kusto (inferred path)
      COM Object Hijacking Via Modification Of Default System CLSID Default Value Sigma (inferred path)
      Potential Persistence Via Scrobj.dll COM Hijacking Sigma (inferred path)
      Stored data is C:\WINDOWS\system32\scrobj.dll
      Classes Autorun Keys Modification Sigma (inferred path)
      COM Hijacking via TreatAs Sigma (inferred path)
      Windows InProcServer32 New Outlook Form Splunk (inferred path)
      Stored data is *\\FORMS\\*
      - HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32#
        
        HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\InProcServer32\(Default)#value
        
        CVE-2021-31979 CVE-2021-33771 Exploits Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{026CC6D7-34B2-33D5-B551-CA31EB6CE345}#
        
        Forest Blizzard APT - Custom Protocol Handler DLL Registry Set Sigma (inferred branch)
      - HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{52A2AAAE-085D-4187-97EA-8C30DB990436}\InprocServer32#
        
        HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{52A2AAAE-085D-4187-97EA-8C30DB990436}\InprocServer32\(Default)#value
        
        Persistence Via Hhctrl.ocx Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}#
        
        Removal Of AMSI Provider Registry Keys Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InProcServer32#
        
        HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InProcServer32\(Default)#value
        
        Potential PSFactoryBuffer COM Hijacking Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32#
        
        HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32\(Default)#value
        
        CVE-2021-31979 CVE-2021-33771 Exploits Sigma (inferred path)
      - HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InprocServer32#
        
        HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InprocServer32\(Default)#value
        
        Potential AMSI COM Server Hijacking Sigma (inferred path)
  - HKLM\SOFTWARE\Clients#
    
    Removal of Potential COM Hijacking Registry Keys Sigma (inferred path)
    Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace Sigma (inferred path)
    Suspicious Shell Open Command Registry Modification Sigma (inferred path)
    Custom File Open Handler Executes PowerShell Sigma (inferred path)
  - HKLM\Software\firm\soft\Name#
    
    Potential Qakbot Registry Activity Sigma (inferred path)
  - HKLM\SOFTWARE\Google#
    
    Windows Chrome Auto-Update Disabled via Registry Splunk (inferred branch)
    - HKLM\SOFTWARE\Google\Chrome#
      
      Windows Chrome Extension Allowed Registry Modification Splunk (inferred branch)
      - HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts#
        
        HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.microsoft.browsercore#
        
        Browser Native Messaging Registry Modification Elastic (inferred path)
        
        HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.microsoft.browsercore\(Default)#value
        
        Browser Native Messaging Registry Modification Elastic (inferred path)
        HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.microsoft.defender.browser_extension.native_message_host#
        
        Browser Native Messaging Registry Modification Elastic (inferred path)
        
        HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.microsoft.defender.browser_extension.native_message_host\(Default)#value
        
        Browser Native Messaging Registry Modification Elastic (inferred path)
  - HKLM\SOFTWARE\Microsoft#
    
    Windows Modify Registry Qakbot Binary Data Registry Splunk (inferred path)
    Windows Installer with Suspicious Properties Elastic (inferred path)
    - HKLM\SOFTWARE\Microsoft\.NETFramework#
      
      Disable ETW Through Registry Splunk (inferred branch)
      ETW Logging Disabled In .NET Processes - Sysmon Registry Sigma (inferred branch)
      Potential Registry Persistence Attempt Via DbgManagedDebugger Sigma (inferred branch)
      NET NGenAssemblyUsageLog Registry Key Tamper Sigma (inferred branch)
      - HKLM\SOFTWARE\Microsoft\.NETFramework\ETWEnabled#value
        
        ETW Logging Disabled In .NET Processes - Registry Sigma (inferred path)
        ETW Registry Disabled Splunk (inferred path)
      - HKLM\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel#
        
        ClickOnce Trust Prompt Tampering Sigma (inferred path)
        Stored data is Enabled
    - HKLM\SOFTWARE\Microsoft\Active Setup#
      - HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components#
        
        Run Once Task Configuration in Registry Sigma (inferred path)
      - HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components#
        
        Common Autorun Keys Modification Sigma (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}#
        
        HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\StubPath#value
        
        Active Setup Registry Autostart Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}#
        
        HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\StubPath#value
        
        Active Setup Registry Autostart Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}#
        
        HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\StubPath#value
        
        Active Setup Registry Autostart Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}#
        
        HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}\StubPath#value
        
        Active Setup Registry Autostart Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}#
        
        HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath#value
        
        Active Setup Registry Autostart Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}#
        
        HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\StubPath#value
        
        Active Setup Registry Autostart Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}#
        
        HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\StubPath#value
        
        Active Setup Registry Autostart Splunk (inferred path)
    - HKLM\SOFTWARE\Microsoft\ActiveSync\Environment#
      
      Privilege Escalation via Windir Environment Variable Elastic (inferred branch)
      Windows Anomalous Registry Value Length in Environment Key Splunk (inferred path)
      Suspicious Environment Variable Has Been Registered Sigma (inferred path)
      Logon Script Event Trigger Execution Splunk (inferred branch)
      NET Profiler UAC bypass Splunk (inferred branch)
      Stored data is *.dll
    - HKLM\SOFTWARE\Microsoft\ADHealthAgent#
      
      Azure AD Health Service Agents Registry Keys Access Sigma
    - HKLM\SOFTWARE\Microsoft\AMSI#
      
      Removal Of AMSI Provider Registry Keys Sigma (inferred path)
      - HKLM\SOFTWARE\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}#
        
        Potential Persistence Via New AMSI Providers - Registry Sigma (inferred path)
    - HKLM\SOFTWARE\Microsoft\COM3\SelfReg\CLSID#
      
      Windows New InProcServer32 Added Splunk (inferred path)
      Potential Persistence Via Scrobj.dll COM Hijacking Sigma (inferred path)
      Stored data is C:\WINDOWS\system32\scrobj.dll
      Windows InProcServer32 New Outlook Form Splunk (inferred path)
      Stored data is *\\FORMS\\*
    - HKLM\SOFTWARE\Microsoft\Cryptography#
      
      Windows Registry SIP Provider Modification Splunk (inferred branch)
      - HKLM\SOFTWARE\Microsoft\Cryptography\OID#
        
        Persistence Via New SIP Provider Sigma (inferred path)
        Suspicious SIP or trust provider registration Sigma (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0#
        
        HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\$DLL#value
        
        Windows Registry SIP Provider Modification Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg#
        
        SIP Provider Modification Elastic (inferred path)
        HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1#
        
        HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\$DLL#value
        
        Windows Registry SIP Provider Modification Splunk (inferred path)
      - HKLM\SOFTWARE\Microsoft\Cryptography\Providers#
        
        Kapeka Backdoor Configuration Persistence Sigma (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Dll#value
        
        Windows Registry SIP Provider Modification Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust#
        
        Persistence Via New SIP Provider Sigma (inferred path)
        Suspicious SIP or trust provider registration Sigma (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy#
        
        SIP Provider Modification Elastic (inferred path)
    - HKLM\SOFTWARE\Microsoft\Edge#
      
      Windows Impair Defense Override SmartScreen Prompt Splunk (inferred branch)
      Stored data is 0x00000000
      - HKLM\SOFTWARE\Microsoft\Edge\NativeMessagingHosts\com.microsoft.defender.browser_extension.native_message_host#
        
        Browser Native Messaging Registry Modification Elastic (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Edge\NativeMessagingHosts\com.microsoft.defender.browser_extension.native_message_host\(Default)#value
        
        Browser Native Messaging Registry Modification Elastic (inferred path)
    - HKLM\Software\Microsoft\Fax\Device Providers#
      
      Change the Fax Dll Sigma (inferred path)
    - HKLM\Software\Microsoft\HtmlHelp Author\Location#
      
      Potential Persistence Via CHM Helper DLL Sigma (inferred path)
    - HKLM\SOFTWARE\Microsoft\HTMLHelp\data#
      
      RedMimicry Winnti Playbook Registry Manipulation Sigma (inferred path)
    - HKLM\SOFTWARE\Microsoft\IdentityCRL\Environment#
      
      Privilege Escalation via Windir Environment Variable Elastic (inferred branch)
      Windows Anomalous Registry Value Length in Environment Key Splunk (inferred path)
      Suspicious Environment Variable Has Been Registered Sigma (inferred path)
      Logon Script Event Trigger Execution Splunk (inferred branch)
      NET Profiler UAC bypass Splunk (inferred branch)
      Stored data is *.dll
    - HKLM\SOFTWARE\Microsoft\InProcLogger\PhoneSvcTrace#
      
      Suspicious Remote Registry Modification Elastic (inferred path)
    - HKLM\SOFTWARE\Microsoft\Internet Explorer#
      - HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\JAVA_VM\CONSOLE#
        
        Windows Modify Registry ValleyRAT C2 Config Splunk (inferred branch)
      - HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{2781761E-28E0-4109-99FE-B9D127C57AFE}#
        
        Removal Of AMSI Provider Registry Keys Sigma (inferred path)
      - HKLM\Software\microsoft\Internet Explorer\Intelliforms#
        
        Windows Unusual Intelliform Storage Registry Access Splunk (inferred path)
      - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main#
        
        Internet Explorer DisableFirstRunCustomize Enabled Sigma (inferred branch)
        
        HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Extensions Off Page#value
        
        Internet Explorer Autorun Keys Modification Sigma (inferred path)
      - HKLM\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute#
        
        HKLM\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\ms-settings#
        
        Windows Modify Registry Utilize ProgIDs Splunk (inferred branch)
        HKLM\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\ms-windows-store#
        
        UAC Bypass via WSReset Execution Hijack Elastic (inferred path)
    - HKLM\SOFTWARE\Microsoft\MdmDiagnostics\Area\Autopilot#
      
      VBScript Payload Stored in Registry Sigma (inferred path)
    - HKLM\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent#
      
      Microsoft Entra ID Health Monitoring Agent Registry Keys Access Kusto
      Azure AD Health Monitoring Agent Registry Keys Access Sigma
    - HKLM\SOFTWARE\Microsoft\MicrosoftOnline\Reporting\MonitoringAgent#
      
      Microsoft Entra ID Health Service Agents Registry Keys Access Kusto
    - HKLM\SOFTWARE\Microsoft\MSDTC\MTxOCI#
      
      Registry Modification for OCI DLL Redirection Sigma (inferred path)
      Values: OracleOciLib or OracleOciLibPath
    - HKLM\SOFTWARE\Microsoft\NetSh#
      
      New Netsh Helper DLL Registered From A Suspicious Location Sigma (inferred path)
      Potential Persistence Via Netsh Helper DLL - Registry Sigma (inferred path)
      Netsh Helper DLL Elastic (inferred path)
      Registry Keys Used For Persistence Splunk (inferred path)
    - HKLM\SOFTWARE\Microsoft\NetSh#
      
      Netsh helper DLL abuse (Reg via Sysmon) Sigma (inferred path)
    - HKLM\Software\Microsoft\Office#
      
      Potential Persistence Via Outlook Today Page Sigma (inferred path)
      Outlook Security Settings Updated - Registry Sigma (inferred path)
      Microsoft Office Protected View Disabled Sigma (inferred path)
      Outlook Task/Note Reminder Received Sigma (inferred path)
      Potential Persistence Via Outlook Home Page Sigma (inferred path)
      Python Function Execution Security Warning Disabled In Excel - Registry Sigma (inferred path)
      Stored data is DWORD (0x00000001)
      Disable Macro Runtime Scan Scope Sigma (inferred path)
      Stored data is DWORD (0x00000000)
    - HKLM\Software\Microsoft\Office#
      
      Potential Persistence Via Excel Add-in - Registry Sigma (inferred path)
      Potential Persistence Via Outlook Today Page Sigma (inferred path)
    - HKLM\Software\Microsoft\Office Test\Special#
      - HKLM\Software\Microsoft\Office Test\Special\Perf#
        
        Office Test Registry Persistence Elastic (inferred path)
      - HKLM\Software\Microsoft\Office test\Special\Perf#
        
        Office Application Startup - Office Test Sigma (inferred path)
    - HKLM\SOFTWARE\Microsoft\PolicyManager\default\DeviceGuard#
      - HKLM\SOFTWARE\Microsoft\PolicyManager\default\DeviceGuard\EnableVirtualizationBasedSecurity#
        
        Windows Credential Guard Disabled - Registry Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        Windows Credential Guard Related Registry Value Deleted - Registry Sigma (inferred path)
      - HKLM\SOFTWARE\Microsoft\PolicyManager\default\DeviceGuard\LsaCfgFlags#
        
        Windows Credential Guard Disabled - Registry Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        Windows Credential Guard Related Registry Value Deleted - Registry Sigma (inferred path)
      - HKLM\SOFTWARE\Microsoft\PolicyManager\default\DeviceGuard\RequirePlatformSecurityFeatures#
        
        Windows Credential Guard Related Registry Value Deleted - Registry Sigma (inferred path)
    - HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell#
      - HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell\ExecutionPolicy#value
        
        Set Default PowerShell Execution Policy To Unrestricted or Bypass Splunk (inferred path)
    - HKLM\SOFTWARE\Microsoft\Provisioning#
      
      Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG Sigma (inferred branch)
    - HKLM\SOFTWARE\Microsoft\Security Center#
      
      UAC Notification Disabled Sigma (inferred branch)
      Stored data is DWORD (0x00000001)
      - HKLM\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}#
        
        HKLM\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46}\REPORTINGEXE#value
        
        Suspicious Antivirus Registration Elastic (inferred path)
    - HKLM\SOFTWARE\Microsoft\SystemCertificates#
      
      Windows Registry Certificate Added Splunk (inferred path)
      New Root or CA or AuthRoot Certificate to Store Sigma (inferred path)
      Stored data is Binary Data
      - HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates#
        
        HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43#
        
        HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob#value
        
        Creation or Modification of Root Certificate Elastic (inferred path)
        New Root or CA or AuthRoot Certificate to Store Sigma (inferred path)
        Stored data is Binary Data
        HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2#
        
        HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob#value
        
        Creation or Modification of Root Certificate Elastic (inferred path)
        New Root or CA or AuthRoot Certificate to Store Sigma (inferred path)
        Stored data is Binary Data
        HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436#
        
        HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob#value
        
        Creation or Modification of Root Certificate Elastic (inferred path)
        New Root or CA or AuthRoot Certificate to Store Sigma (inferred path)
        Stored data is Binary Data
        HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474#
        
        HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob#value
        
        Creation or Modification of Root Certificate Elastic (inferred path)
        New Root or CA or AuthRoot Certificate to Store Sigma (inferred path)
        Stored data is Binary Data
        HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD#
        
        HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob#value
        
        Creation or Modification of Root Certificate Elastic (inferred path)
        New Root or CA or AuthRoot Certificate to Store Sigma (inferred path)
        Stored data is Binary Data
        HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4#
        
        HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob#value
        
        Creation or Modification of Root Certificate Elastic (inferred path)
        New Root or CA or AuthRoot Certificate to Store Sigma (inferred path)
        Stored data is Binary Data
        HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4#
        
        HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob#value
        
        Creation or Modification of Root Certificate Elastic (inferred path)
      - HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates#
        
        Creation or Modification of Root Certificate Elastic (inferred path)
    - HKLM\SOFTWARE\Microsoft\Terminal Server Client#
      
      Windows Modify Registry AuthenticationLevelOverride Splunk (inferred branch)
      Stored data is 0x00000000
      Terminal Server Client Connection History Cleared - Registry Sigma (inferred branch)
      Windows RDP Server Registry Entry Created Splunk (inferred branch)
      Windows RDP Server Registry Deletion Splunk (inferred branch)
    - HKLM\SOFTWARE\Microsoft\Test#
      
      Windows SnappyBee Create Test Registry Splunk (inferred path)
    - HKLM\SOFTWARE\Microsoft\WAB\DLLPath#
      
      Execution DLL of Choice Using WAB.EXE Sigma (inferred path)
    - HKLM\SOFTWARE\Microsoft\wbem#
      - HKLM\SOFTWARE\Microsoft\wbem\AmsiEnable#value
        
        Modification of AmsiEnable Registry Key Elastic (inferred path)
        Stored data is 0 or 0x00000000
      - HKLM\SOFTWARE\Microsoft\Wbem\CIMOM#
        
        HKLM\SOFTWARE\Microsoft\Wbem\CIMOM\AllowAnonymousCallback#value
        
        Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback Sigma (inferred path)
        Stored data is DWORD (0x00000001)
    - HKLM\SOFTWARE\Microsoft\Windows#
      - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion#
        
        Registry Run Keys - Suspicious Registry Run Keys Kusto (inferred path)
        VBScript Payload Stored in Registry Sigma (inferred path)
        Registry Keys Used For Persistence Splunk (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths#
        
        Sdclt UAC Bypass Splunk (inferred branch)
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe#
        
        CMSTP App Paths Registry Key Modification Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEDIAG.EXE#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEDIAG.EXE\Path#value
        
        Potential Persistence Via App Paths Default Property Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEDIAGCMD.EXE#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEDIAGCMD.EXE\Path#value
        
        Potential Persistence Via App Paths Default Property Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE\Path#value
        
        Potential Persistence Via App Paths Default Property Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mplayer2.exe#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\mplayer2.exe\Path#value
        
        Potential Persistence Via App Paths Default Property Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msedge.exe#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msedge.exe\Path#value
        
        Potential Persistence Via App Paths Default Property Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\wab.exe#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\wab.exe\Path#value
        
        Potential Persistence Via App Paths Default Property Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\wmplayer.exe#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\wmplayer.exe\Path#value
        
        Potential Persistence Via App Paths Default Property Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost\EnableWebContentEvaluation#value
        
        Windows Impair Defense Disable Web Evaluation Splunk (inferred path)
        Stored data is 0 or 0x00000000
        HKLM\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\AppModelUnlock#
        
        HKLM\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\AppModelUnlock\AllowDevelopmentWithoutDevLicense#value
        
        Potential Signing Bypass Via Windows Developer Features - Registry Sigma (inferred path)
        Stored data is DWORD (0x00000001)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication#
        
        CurrentVersion Autorun Keys Modification Sigma (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\{DDC0EED2-ADBE-40b6-A217-EDE16A79A0DE}#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\{DDC0EED2-ADBE-40b6-A217-EDE16A79A0DE}\(Default)#value
        
        CurrentVersion Autorun Keys Modification Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers\{5537E283-B1E7-4EF8-9C6E-7AB0AFE5056D}#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers\{5537E283-B1E7-4EF8-9C6E-7AB0AFE5056D}\(Default)#value
        
        CurrentVersion Autorun Keys Modification Sigma (inferred path)
        HKLM\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager#
        
        HKLM\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\CapabilityAccessManager\Capabilities\webcam\Services#
        
        DHCP Callout DLL Installation Sigma (inferred branch)
        HKLM\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore#
        
        Suspicious Camera and Microphone Access Sigma (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged#
        
        Processes Accessing the Microphone and Webcam Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged#
        
        Processes Accessing the Microphone and Webcam Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls#
        
        DLL Control Panel Items Registry Modification Elastic (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer#
        
        Suspicious Startup Shell Folder Modification Elastic (inferred path)
        Potentially Suspicious Command Executed Via Run Dialog Box - Registry Sigma (inferred branch)
        FileFix - Command Evidence in TypedPaths Sigma (inferred branch)
        Windows RunMRU Command Execution Splunk (inferred path)
        Command Executed Via Run Dialog Box - Registry Sigma (inferred branch)
        Suspicious Space Characters in TypedPaths Registry Path - FileFix Sigma (inferred branch)
        Suspicious Space Characters in RunMRU Registry Path - ClickFix Sigma (inferred branch)
        CurrentVersion Autorun Keys Modification Sigma (inferred path)
        Potential ClickFix Execution Pattern - Registry Sigma (inferred branch)
        Windows RunMRU Registry Key or Value Deleted Splunk (inferred branch)
        RunMRU Registry Key Deletion - Registry Sigma (inferred branch)
        Potential Persistence Via TypedPaths Sigma (inferred branch)
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\(Default)#value
        
        CurrentVersion Autorun Keys Modification Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer#
        
        Potential Persistence Via MyComputer Registry Keys Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs#
        
        Windows Phishing Recent ISO Exec Registry Splunk (inferred branch)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Startup#value
        
        Modify User Shell Folders Startup Value Sigma (inferred path)
        Unusual Startup Shell Folder Modification Elastic (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A}#
        
        COM Registry Key Modified to Point to File in Color Profile Folder Kusto (inferred path)
        HKLM\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\SmartScreenEnabled#value
        
        Disable Windows SmartScreen Protection Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders#
        
        Modify User Shell Folders Startup Value Chronicle (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Backup#
        
        Modify User Shell Folders Startup Value Chronicle (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Backup\Startup#value
        
        Modify User Shell Folders Startup Value Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Startup#value
        
        Modify User Shell Folders Startup Value Sigma (inferred path)
        Unusual Startup Shell Folder Modification Elastic (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Diagnostic Data Viewer database files#
        
        Persistence Via Disk Cleanup Handler - Autorun Sigma (inferred path)
        Values: CleanupString or PreCleanupString
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Windows Error Reporting Files#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Windows Error Reporting Files\PreCleanupString#value
        
        Persistence Via Disk Cleanup Handler - Autorun Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\Windows Reset Log Files#
        
        Potential Persistence Via Disk Cleanup Handler - Registry Sigma (inferred path)
        HKLM\software\microsoft\windows\currentversion\group policy\scripts#
        
        HKLM\software\microsoft\windows\currentversion\group policy\scripts\logoff#
        HKLM\software\microsoft\windows\currentversion\group policy\scripts\logon#
        
        CurrentVersion Autorun Keys Modification Chronicle (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ImmersiveShell#
        
        Windows Modify Registry Disable Windows Security Center Notif Splunk (inferred branch)
        Stored data is 0x00000000
        Disable Windows Security Center Notifications Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products#
        
        Remote MSI Package Installation via MSIEXEC Elastic (inferred path)
        HKLM\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Internet Settings#
        
        Modification of IE Registry Settings Sigma (inferred path)
        Registry Modification from a Potentially Altered Call Stack Elastic (inferred path)
        Potential Hardware Breakpoints Evasion Elastic (inferred path)
        Windows Modify Registry MaxConnectionPerServer Splunk (inferred path)
        Values: MaxConnectionsPer1_0Server or MaxConnectionsPerServer
        Stored data is 0x0000000a
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap#
        
        Potential Raspberry Robin Registry Set Internet Settings ZoneMap Sigma (inferred path)
        Values: AutoDetect or IntranetName or ProxyByPass or UNCAsIntranet
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults#
        
        IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Sigma (inferred path)
        Values: http or https
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Lxss#
        
        Windows Subsystem for Linux Distribution Installed Elastic (inferred branch)
        HKLM\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Management Infrastructure\Protocols#
        
        Forest Blizzard APT - Custom Protocol Handler Creation Sigma (inferred branch)
        Stored data is {026CC6D7-34B2-33D5-B551-CA31EB6CE345}
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\MicrosoftEdge#
        
        Windows Impair Defense Overide Win Defender Phishing Filter Splunk (inferred branch)
        Stored data is 0x00000000
        HKLM\Software\Microsoft\Windows\CurrentVersion\PackagedAppXDebug#
        
        Potential Persistence Using DebugPath Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies#
        
        Disable Internal Tools or Feature in Registry Chronicle (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop#
        
        Windows Modify Registry NoChangingWallPaper Splunk (inferred branch)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations#
        
        Potential Attachment Manager Settings Associations Tamper Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments\ScanWithAntiVirus#value
        
        Potential Attachment Manager Settings Attachments Tamper Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer#
        
        Registry Run Key Prefixed with Asterisk Elastic (inferred branch)
        Disabling NoRun Windows App Splunk (inferred branch)
        Windows Disable Windows Group Policy Features Through Registry Splunk (inferred branch)
        Registry Persistence via Explorer Run Key Sigma (inferred branch)
        Disabling FolderOptions Windows Feature Splunk (inferred branch)
        Windows Disable LogOff Button Through Registry Splunk (inferred path)
        Values: NoLogOff or StartMenuLogOff
        Script Interpreter Process Writing to Commonly Abused Persistence Locations Elastic (inferred branch)
        Registry Run Key Modified by Unusual Process Elastic (inferred branch)
        Registry Hide Function from User Sigma (inferred branch)
        Startup Persistence via Windows Script Interpreter Elastic (inferred branch)
        Suspicious Powershell In Registry Run Keys Chronicle (inferred branch)
        Untrusted Process Writing to Commonly Abused Persistence Locations Elastic (inferred branch)
        Startup Persistence from Backed RWX Memory Elastic (inferred branch)
        Registry Explorer Policy Modification Sigma (inferred branch)
        Values: NoDesktop or NoSetTaskbar or NoTrayContextMenu
        Stored data is DWORD (0x00000001)
        Suspicious Startup Persistence via a Windows Installer Elastic (inferred branch)
        Persistence via a Windows Installer Elastic (inferred branch)
        Windows Hide Notification Features Through Registry Splunk (inferred path)
        Values: HideSCAHealth or HideSCANetwork or HideSCAPower or HideSCAVolume
        Stored data is 0x00000001
        
        HKLM\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Policies\Explorer\DisallowRun#value
        
        Add DisallowRun Execution to Registry Sigma (inferred path)
        Stored data is DWORD (0x00000001)
        Windows Modify Registry DisAllow Windows App Splunk (inferred path)
        Stored data is 0x00000001
        HKLM\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Policies\Explorer\HideClock#value
        
        Registry Hide Function from User Sigma (inferred path)
        Windows Hide Notification Features Through Registry Splunk (inferred path)
        Stored data is 0x00000001
        HKLM\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Policies\Explorer\NoClose#value
        
        Windows Disable Shutdown Button Through Registry Splunk (inferred path)
        Registry Explorer Policy Modification Sigma (inferred path)
        Stored data is DWORD (0x00000001)
        HKLM\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Policies\Explorer\NoControlPanel#value
        
        Disable Internal Tools or Feature in Registry Sigma (inferred path)
        Disabling ControlPanel Splunk (inferred path)
        Registry Explorer Policy Modification Sigma (inferred path)
        Stored data is DWORD (0x00000001)
        HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run#
        
        Persistence via WMI Standard Registry Provider Elastic (path prefix)
        Persistence via Hidden Run Key Detected Elastic (inferred path)
        New RUN Key Pointing to Suspicious Folder Chronicle (inferred path)
        Registry or File Modification from Suspicious Memory Elastic (inferred path)
        Suspicious String Value Written to Registry Run Key Elastic (inferred path)
        Startup or Run Key Registry Modification Elastic (path prefix)
        HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run#
        
        Suspicious Run Key from Download Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System#
        
        Disabling Task Manager Splunk (inferred branch)
        Windows Disable Change Password Through Registry Splunk (inferred branch)
        Disable Registry Tool Splunk (inferred branch)
        Windows Disable Lock Workstation Feature Through Registry Splunk (inferred branch)
        Potential Ransomware Activity Using LegalNotice Message Sigma (inferred path)
        Values: legalnoticecaption or legalnoticetext
        Defense Evasion via Registry Modification Elastic (inferred path)
        Windows Disable Windows Group Policy Features Through Registry Splunk (inferred branch)
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin#value
        
        Disabling User Account Control via Registry Modification Elastic (inferred path)
        Allow Operation with Consent Admin Splunk (inferred path)
        Stored data is 0x00000000
        Disable Internal Tools or Feature in Registry Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections#
        
        Blackbyte Ransomware Registry Chronicle
        HKLM\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Policies\SYSTEM\EnableLinkedConnections#value
        
        Blackbyte Ransomware Registry Sigma (inferred path)
        Stored data is DWORD (0x00000001)
        Windows Modify Registry EnableLinkedConnections Splunk (inferred path)
        Stored data is 0x00000001
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA#value
        
        Disabling Remote User Account Control Splunk (inferred path)
        Stored data is 0x00000000
        UAC Disabled Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        User Account Control Disabled via Registry Elastic (inferred path)
        Stored data is 0
        Disabling User Account Control via Registry Modification Elastic (inferred path)
        HKLM\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Policies\SYSTEM\InactivityTimeoutSecs#value
        
        Disable Internal Tools or Feature in Registry Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy#
        
        Blackbyte Ransomware Registry Chronicle
        HKLM\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Policies\SYSTEM\LocalAccountTokenFilterPolicy#value
        
        Local Account TokenFilter Policy Disabled Elastic (inferred path)
        Disable UAC Remote Restriction Splunk (inferred path)
        Blackbyte Ransomware Registry Sigma (inferred path)
        Stored data is DWORD (0x00000001)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop#value
        
        UAC Secure Desktop Prompt Disabled Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        Disabling User Account Control via Registry Modification Elastic (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\scforceoption#value
        
        Windows Modify Registry on Smart Card Group Policy Splunk (inferred path)
        Stored data is 0x00000001
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon#value
        
        Disable Internal Tools or Feature in Registry Sigma (inferred path)
        Windows Disable Shutdown Button Through Registry Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications#
        
        Windows Modify Registry Disable Toast Notifications Splunk (inferred branch)
        Stored data is 0x00000000
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\ToastEnabled#
        
        Disable Internal Tools or Feature in Registry Chronicle (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run#
        
        New RUN Key Pointing to Suspicious Folder Sigma (inferred path)
        Suspicious Powershell In Registry Run Keys Chronicle (inferred path)
        Suspicious PowerShell In Registry Run Keys Sigma (inferred path)
        Detect Remote Access Software Usage Registry Splunk (inferred path)
        Potential REMCOS Trojan Execution Elastic (inferred path)
        Values: Remcos or Rmc-??????
        Registry Run Key Prefixed with Asterisk Elastic (inferred branch)
        Detect Registry Run Key Creation/Modification Kusto (inferred path)
        Persistence via Hidden Run Key Detected Elastic (inferred path)
        New RUN Key Pointing to Suspicious Folder Chronicle (inferred path)
        Suspicious Remote Registry Modification Elastic (inferred path)
        Suspicious String Value Written to Registry Run Key Elastic (inferred path)
        CurrentVersion Autorun Keys Modification Sigma (inferred path)
        Startup Persistence by a Low Reputation Process Elastic (inferred path)
        Startup or Run Key Registry Modification Elastic (path prefix)
        Add DLL_EXE Registry Value (Sysmon) Splunk (inferred path) Path reference
        
        HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Backup Mgr#
        
        WINEKEY Registry Modification Sigma (inferred path)
        HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ntkd#
        
        Leviathan Registry Key Activity Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealth#value
        
        Script Interpreter Process Writing to Commonly Abused Persistence Locations Elastic (inferred path)
        Registry Run Key Modified by Unusual Process Elastic (inferred path)
        Small Sieve Malware Registry Persistence Sigma (inferred path)
        Startup Persistence via Windows Script Interpreter Elastic (inferred path)
        Untrusted Process Writing to Commonly Abused Persistence Locations Elastic (inferred path)
        Startup Persistence from Backed RWX Memory Elastic (inferred path)
        Potential PlugX Registry Modification Elastic (inferred path)
        Suspicious Startup Persistence via a Windows Installer Elastic (inferred path)
        Persistence via a Windows Installer Elastic (inferred path)
        Persistence via a Process from a Removable or Mounted ISO Device Elastic (inferred path)
        Persistence via WMI Standard Registry Provider Elastic (inferred path)
        Startup Persistence from a Browser or Compression Utility Descendant Elastic (inferred path)
        New RUN Key Pointing to Suspicious Folder Sigma (inferred path)
        Suspicious PowerShell In Registry Run Keys Sigma (inferred path)
        Dual Persistence via Startup and Scheduled Task Elastic (inferred path)
        Startup or Run Key Registry Modification Elastic (inferred path)
        Detect Remote Access Software Usage Registry Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VMware User Process#value
        
        Persistence via a Process from a Removable or Mounted ISO Device Elastic (inferred path)
        Script Interpreter Process Writing to Commonly Abused Persistence Locations Elastic (inferred path)
        Persistence via WMI Standard Registry Provider Elastic (inferred path)
        Startup Persistence from a Browser or Compression Utility Descendant Elastic (inferred path)
        Registry Run Key Modified by Unusual Process Elastic (inferred path)
        New RUN Key Pointing to Suspicious Folder Sigma (inferred path)
        Small Sieve Malware Registry Persistence Sigma (inferred path)
        Startup Persistence via Windows Script Interpreter Elastic (inferred path)
        Suspicious PowerShell In Registry Run Keys Sigma (inferred path)
        Dual Persistence via Startup and Scheduled Task Elastic (inferred path)
        Untrusted Process Writing to Commonly Abused Persistence Locations Elastic (inferred path)
        Startup Persistence from Backed RWX Memory Elastic (inferred path)
        Startup or Run Key Registry Modification Elastic (inferred path)
        Potential PlugX Registry Modification Elastic (inferred path)
        Detect Remote Access Software Usage Registry Splunk (inferred path)
        Suspicious Startup Persistence via a Windows Installer Elastic (inferred path)
        Persistence via a Windows Installer Elastic (inferred path)
        HKLM\Software\Microsoft\Windows\CurrentVersion\Run#
        
        Suspicious Run Key from Download Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce#
        
        Registry Run Key Prefixed with Asterisk Elastic (inferred branch)
        Detect Registry Run Key Creation/Modification Kusto (inferred path)
        Script Interpreter Process Writing to Commonly Abused Persistence Locations Elastic (inferred branch)
        New RUN Key Pointing to Suspicious Folder Sigma (inferred path)
        Startup Persistence via Windows Script Interpreter Elastic (inferred branch)
        Suspicious Powershell In Registry Run Keys Chronicle (inferred path)
        Suspicious PowerShell In Registry Run Keys Sigma (inferred path)
        Detect Remote Access Software Usage Registry Splunk (inferred path)
        Add DLL_EXE Registry Value (Sysmon) Splunk (inferred path) Path reference
        HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx#
        
        Persistence via WMI Standard Registry Provider Elastic (path prefix)
        Startup or Run Key Registry Modification Elastic (path prefix)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKCR\CLSID#
        
        Windows New InProcServer32 Added Splunk (inferred path)
        Windows InProcServer32 New Outlook Form Splunk (inferred path)
        Stored data is *\\FORMS\\*
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SOFTWARE#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SOFTWARE\Microsoft#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion#
        
        Potential Credential Dumping Via LSASS SilentProcessExit Technique Chronicle (inferred branch)
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WUDF\Services#
        
        PowerShell as a Service in Registry Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels#
        
        Disable Windows Event Logging Via Registry Sigma (inferred path)
        Sysmon Channel Reference Deletion Sigma (inferred branch)
        Change Winevt Channel Access Permission Via Registry Sigma (inferred path)
        Windows Event Log Access Tampering Via Registry Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers#
        
        Sysmon Channel Reference Deletion Sigma (inferred branch)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion#
        
        Potential Credential Dumping Via LSASS SilentProcessExit Technique Chronicle (inferred branch)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SYSTEM\CurrentControlSet#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SYSTEM\CurrentControlSet\Control#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\iai2c.sys#
        
        Windows Registry Modification for Safe Mode Persistence Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\{152fbe4b-c7ad-4f68-bada-a4fcc1464f6c}\Enabled#
        
        Potential AutoLogger Sessions Tampering Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpResources\Registry\HKLM\SYSTEM\CurrentControlSet\Services#
        
        Potential CobaltStrike Service Installations - Registry Sigma (inferred path)
        Windows Service Deletion In Registry Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad#
        
        CurrentVersion Autorun Keys Modification Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\UMe#
        
        OilRig APT Registry Persistence Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall#
        
        Remote MSI Package Installation via MSIEXEC Elastic (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\UT#
        
        OilRig APT Registry Persistence Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels#
        
        Windows New EventLog ChannelAccess Registry Value Set Splunk (inferred path)
        Disable Windows Event Logging Via Registry Sigma (inferred path)
        Windows Event Log Access Tampering Via Registry Sigma (inferred path)
        Sysmon Channel Reference Deletion Sigma (inferred branch)
        Change Winevt Channel Access Permission Via Registry Sigma (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Sysmon/Operational#
        
        Sysmon Channel Reference Deletion Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational#
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\Enabled#value
        
        Disabled Windows Defender Eventlog Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers#
        
        Sysmon Channel Reference Deletion Sigma (inferred branch)
        
        HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9}#
        
        Sysmon Channel Reference Deletion Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Wosc\Client\Persistent\ClientState\FILTERMANAGER#
        
        Antivirus Filter Driver Disallowed On Dev Drive - Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
      - HKLM\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\ms-settings#
        
        Windows Modify Registry Utilize ProgIDs Splunk (inferred branch)
      - HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting#
        
        Windows Modify Registry Disabling WER Settings Splunk (inferred path)
        Values: DisableArchive or DISABLED or DisableEnterpriseAuthProxy or DisableWerUpload
        Stored data is 0x00000001
        Lsass Full Dump Request Via DumpType Registry Settings Sigma (inferred branch)
        Stored data is DWORD (0x00000002)
        
        HKLM\SOFTWARE\Microsoft\WINDOWS\Windows Error Reporting\DontShowUI#value
        
        Windows Modify Registry DontShowUI Splunk (inferred path)
        Stored data is 0x00000001
        HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Hangs#
        
        Add Debugger Entry To Hangs Key For Persistence Sigma (inferred branch)
        
        HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Hangs\ReflectDebugger#value
        
        Werfault ReflectDebugger Persistence Elastic (documented path)
        Potential WerFault ReflectDebugger Registry Value Abuse Sigma (documented path) Path reference
        HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\DumpType#
        
        Full User-Mode Dumps Enabled System-Wide Elastic
    - HKLM\SOFTWARE\Microsoft\Windows Defender#
      
      Disable Windows Defender Functionalities Via Registry Keys Sigma (inferred path)
      Microsoft Windows Defender Tampering Elastic (inferred path)
      Windows Impair Defense Configure App Install Control Splunk (inferred branch)
      - HKLM\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware#value
        
        Windows DisableAntiSpyware Registry Splunk (inferred path)
        Stored data is 0x00000001
      - HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions#
        
        Windows Defender Exclusions Added - Registry Sigma (inferred path)
        Windows Defender Exclusion Registry Key - Write Access Requested Sigma (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions#
        
        MosaicLoader Kusto (inferred path)
        Windows Defender Exclusion List Modified Sigma (inferred path)
        Windows Defender Exclusions Added - Registry Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\IpAddresses#
        
        Windows Defender Exclusion List Modified Sigma (inferred path)
        Windows Defender Exclusions Added - Registry Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths#
        
        Windows Defender Exclusions by Path Elastic (inferred branch)
        MosaicLoader Kusto (inferred path)
        Windows Defender Exclusion List Modified Sigma (inferred path)
        Windows Defender Exclusions Added - Registry Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes#
        
        MosaicLoader Kusto (inferred path)
        Windows Defender Exclusion List Modified Sigma (inferred path)
        Windows Defender Exclusions by Path Elastic (inferred branch)
        Windows Defender Exclusions Added - Registry Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths#
        
        Windows Defender Exclusion List Modified Sigma (inferred path)
        Windows Defender Exclusions Added - Registry Sigma (inferred path)
      - HKLM\SOFTWARE\Microsoft\Windows Defender\Features#
        
        HKLM\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection#value
        
        Windows Modify Registry Tamper Protection Splunk (inferred path)
        Stored data is 0x00000000
        Disable Tamper Protection on Windows Defender Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        HKLM\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtectionSource#value
        
        Disable Tamper Protection on Windows Defender Sigma (inferred path)
        Stored data is DWORD (0x00000000)
      - HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine#
        
        Suspicious Windows Defender Registry Modification Elastic (inferred path)
        Stored data is 1
        
        HKLM\SOFTWARE\Microsoft\Windows Defender\MpEngine\EnableFileHashComputation#value
        
        Windows Impair Defense Disable Win Defender Compute File Hashes Splunk (inferred path)
        Stored data is 0x00000000
      - HKLM\SOFTWARE\Microsoft\Windows Defender\NIS#
        
        Windows Impair Defense Disable Defender Protocol Recognition Splunk (inferred branch)
        Stored data is 0x00000001
        
        HKLM\SOFTWARE\Microsoft\Windows Defender\NIS\Consumers\IPS#
        
        Windows Impair Defense Disable Win Defender Signature Retirement Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Impair Defense Change Win Defender Throttle Rate Splunk (inferred branch)
      - HKLM\SOFTWARE\Microsoft\Windows Defender\PUAProtection#value
        
        Windows Impair Defense Disable PUA Protection Splunk (inferred path)
        Stored data is 0x00000000
      - HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection#
        
        Disable Windows Behavior Monitoring Splunk (inferred path)
        Values: DisableIntrusionPreventionSystem or DisableIOAVProtection or DisableRealtimeMonitoring or DisableScriptScanning
        Suspicious Windows Defender Registry Modification Elastic (inferred path)
        Stored data is 1
        
        HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification#value
        
        Windows Modify Registry Disable Win Defender Raw Write Notif Splunk (inferred path)
        Stored data is 0x00000001
      - HKLM\SOFTWARE\Microsoft\Windows Defender\Reporting#
        
        Windows Impair Defense Disable Win Defender Gen reports Splunk (inferred branch)
        Stored data is 0x00000001
        
        HKLM\SOFTWARE\Microsoft\Windows Defender\Reporting\DisableEnhancedNotifications#value
        
        Disable Defender Enhanced Notification Splunk (inferred path)
        Stored data is 0x00000001
        HKLM\SOFTWARE\Microsoft\Windows Defender\Reporting\WppTracingLevel#value
        
        Windows Impair Defense Change Win Defender Tracing Level Splunk (inferred path)
        Stored data is 0x00000001
      - HKLM\SOFTWARE\Microsoft\Windows Defender\Scan#
        
        Suspicious Windows Defender Registry Modification Elastic (inferred path)
        Stored data is 1
        
        HKLM\SOFTWARE\Microsoft\Windows Defender\Scan\QuickScanInterval#value
        
        Windows Impair Defense Change Win Defender Quick Scan Interval Splunk (inferred path)
      - HKLM\SOFTWARE\Microsoft\Windows Defender\ServiceKeepAlive#value
        
        Windows Impair Defense Change Win Defender Health Check Intervals Splunk (inferred path)
        Stored data is 0x00000001
      - HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates#
        
        HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates\DisableScanOnUpdate#value
        
        Windows Impair Defense Disable Win Defender Scan On Update Splunk (inferred path)
        Stored data is 0x00000001
        HKLM\SOFTWARE\Microsoft\Windows Defender\Signature Updates\RealTimeSignatureDelivery#value
        
        Windows Impair Defense Disable Realtime Signature Delivery Splunk (inferred path)
        Stored data is 0x00000000
      - HKLM\SOFTWARE\Microsoft\Windows Defender\Spynet#
        
        HKLM\SOFTWARE\Microsoft\Windows Defender\Spynet\DisableBlockAtFirstSeen#value
        
        Disable Defender BlockAtFirstSeen Feature Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows Defender\Spynet\SpyNetReporting#value
        
        Disable Defender Spynet Reporting Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent#value
        
        Disable Defender Submit Samples Consent Feature Splunk (inferred path)
      - HKLM\SOFTWARE\Microsoft\Windows Defender\Threats#
        
        HKLM\SOFTWARE\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction#
        
        Windows Defender Threat Severity Default Action Modified Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction#
        
        Windows Impair Defense Define Win Defender Threat Action Splunk (inferred path)
        Stored data is 0x00000001 or 9
      - HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration#
        
        HKLM\SOFTWARE\Microsoft\Windows Defender\UX Configuration\Notification_Suppress#value
        
        Windows Modify Registry Suppress Win Defender Notif Splunk (inferred path)
        Stored data is 0x00000001
      - HKLM\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard#
        
        HKLM\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access#
        
        HKLM\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications#
        
        Suspicious Application Allowed Through Exploit Guard Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\EnableControlledFolderAccess#value
        
        Windows Impair Defense Disable Controlled Folder Access Splunk (inferred path)
        Stored data is 0x00000000
        HKLM\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders#
        
        Folder Removed From Exploit Guard ProtectedFolders List - Registry Sigma (inferred path)
        Windows Defender Exploit Guard Tamper Sigma (inferred path) Path reference
        HKLM\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection#
        
        HKLM\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Network Protection\EnableNetworkProtection#value
        
        Windows Impair Defense Disable Win Defender Network Protection Splunk (inferred path)
        Stored data is 0x00000000
    - HKLM\SOFTWARE\Microsoft\Windows Defender Security Center#
      
      Microsoft Windows Defender Tampering Elastic (inferred path)
      - HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Firewall and network protection#
        
        HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Firewall and network protection\UILockdown#value
        
        Windows Impair Defense Disable Defender Firewall And Network Splunk (inferred path)
        Stored data is 0x00000001
    - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion#
      
      Registry Keys Used For Persistence Splunk (inferred path)
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs#
        
        Atbroker Registry Change Sigma (inferred path) Path reference
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug#
        
        Add Debugger Entry To AeDebug For Persistence Sigma (inferred branch)
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags#
        
        Registry Keys for Creating SHIM Databases Splunk (inferred branch)
        Potential Persistence Via Shim Database Modification Sigma (inferred branch)
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant#
        
        UAC Bypass Using Windows Media Player - Registry Sigma (inferred branch)
        Stored data is Binary Data
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom#
        
        Registry Keys for Creating SHIM Databases Splunk (inferred path)
        Potential Persistence Via Shim Database Modification Sigma (inferred branch)
        Installation of Custom Shim Databases Elastic (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom#
        
        Suspicious Shim Database Patching Activity Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB#
        
        Potential Persistence Via Shim Database In Uncommon Location Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers#
        
        Potential Persistence Via AppCompat RegisterAppRestart Layer Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController#
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\AppInv#
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\AppInv\Command#value
        
        Potential Registry Persistence Attempt Via Windows Telemetry Sigma (inferred path)
        Windows Compatibility Telemetry Tampering Through Registry Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\AppInvKB#
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\AppInvKB\Command#value
        
        Potential Registry Persistence Attempt Via Windows Telemetry Sigma (inferred path)
        Windows Compatibility Telemetry Tampering Through Registry Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\Appraiser#
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\Appraiser\Command#value
        
        Potential Registry Persistence Attempt Via Windows Telemetry Sigma (inferred path)
        Windows Compatibility Telemetry Tampering Through Registry Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\AvStatus#
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\AvStatus\Command#value
        
        Potential Registry Persistence Attempt Via Windows Telemetry Sigma (inferred path)
        Windows Compatibility Telemetry Tampering Through Registry Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\DevInv#
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\DevInv\Command#value
        
        Potential Registry Persistence Attempt Via Windows Telemetry Sigma (inferred path)
        Windows Compatibility Telemetry Tampering Through Registry Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\Encapsulation#
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\Encapsulation\Command#value
        
        Potential Registry Persistence Attempt Via Windows Telemetry Sigma (inferred path)
        Windows Compatibility Telemetry Tampering Through Registry Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\InvAgent#
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\InvAgent\Command#value
        
        Potential Registry Persistence Attempt Via Windows Telemetry Sigma (inferred path)
        Windows Compatibility Telemetry Tampering Through Registry Splunk (inferred path)
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Console#
        
        Windows Modify Registry ValleyRAT C2 Config Splunk (inferred branch)
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32#
        
        CurrentVersion NT Autorun Keys Modification Sigma (inferred path)
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Event Viewer#
        
        Potential Persistence Via Event Viewer Events.asp Sigma (inferred path)
        Values: MicrosoftRedirectionProgram or MicrosoftRedirectionProgramCommandLineParameters or MicrosoftRedirectionURL
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Font Drivers#
        
        CurrentVersion NT Autorun Keys Modification Sigma (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Font Drivers\Adobe Type Manager#value
        
        CurrentVersion NT Autorun Keys Modification Sigma (inferred path)
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options#
        
        Command Line Utility Added to Accessibility Features (Windows Event Log) Splunk (inferred path) Path reference
        Command Line Utility Added to Accessibility Features (Sysmon) Splunk (inferred path) Path reference
        Stickey key IFEO registry changed (Reg via Sysmon) Sigma (inferred branch)
        Potential Persistence Via GlobalFlags Sigma (inferred path)
        CurrentVersion NT Autorun Keys Modification Sigma (inferred path)
        Sticky Key Like Backdoor Usage - Registry Sigma (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe#
        
        Registry Keys Used For Privilege Escalation Splunk (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe\Debugger#value
        
        Image File Execution Options Injection Elastic (inferred path)
        Disable Windows App Hotkeys Splunk (inferred path)
        Suspicious Image File Execution Options Modification Elastic (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe#
        
        Registry Keys Used For Privilege Escalation Splunk (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\Debugger#value
        
        Image File Execution Options Injection Elastic (inferred path)
        Disable Windows App Hotkeys Splunk (inferred path)
        Suspicious Image File Execution Options Modification Elastic (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe#
        
        Registry Keys Used For Privilege Escalation Splunk (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger#value
        
        Image File Execution Options Injection Elastic (inferred path)
        Disable Windows App Hotkeys Splunk (inferred path)
        Suspicious Image File Execution Options Modification Elastic (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RuntimeBroker.exe#
        
        Registry Keys Used For Privilege Escalation Splunk (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RuntimeBroker.exe\Debugger#value
        
        Image File Execution Options Injection Elastic (inferred path)
        Disable Windows App Hotkeys Splunk (inferred path)
        Suspicious Image File Execution Options Modification Elastic (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe#
        
        Registry Keys Used For Privilege Escalation Splunk (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe\Debugger#value
        
        Image File Execution Options Injection Elastic (inferred path)
        Disable Windows App Hotkeys Splunk (inferred path)
        Suspicious Image File Execution Options Modification Elastic (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe#
        
        Registry Keys Used For Privilege Escalation Splunk (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe\Debugger#value
        
        Image File Execution Options Injection Elastic (inferred path)
        Disable Windows App Hotkeys Splunk (inferred path)
        Suspicious Image File Execution Options Modification Elastic (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe\MinimumStackCommitInBytes#value
        
        Potential Evasion via Stack Rumbling Elastic (inferred path)
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping#
        
        CurrentVersion NT Autorun Keys Modification Sigma (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini\Windows#
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini\Windows\APPINIT_DLLS#value
        
        Registry Persistence via AppInit DLL Elastic (inferred path)
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{D7888638-DEFB-425C-8FF3-ED3F8A0F2952}#
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{D7888638-DEFB-425C-8FF3-ED3F8A0F2952}\Category#value
        
        Windows Set Network Profile Category to Private via Registry Splunk (inferred path)
        Stored data is 0x00000001
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports#
        
        CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry Sigma (inferred path)
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\Microsoft Print to PDF#
        
        Suspicious Print Spooler Point and Print DLL Elastic (inferred branch)
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers\Microsoft Print to PDF\SpoolDirectory#value
        
        Suspicious Print Spooler Point and Print DLL Elastic (inferred path)
        Stored data is C:\Windows\System32\spool\drivers\x64\4
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList#
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-973394255-3265199611-3641254755-1000#
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-973394255-3265199611-3641254755-1000\ProfileImagePath#value
        
        Potential COLDSTEEL RAT Windows User Creation Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-973394255-3265199611-3641254755-1001#
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-973394255-3265199611-3641254755-1001\ProfileImagePath#value
        
        Potential COLDSTEEL RAT Windows User Creation Sigma (inferred path)
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule#
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration#
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration\EnableAt#value
        
        Windows Enable Win32 ScheduledJob via Registry Splunk (inferred path)
        Scheduled Tasks AT Command Enabled Elastic (inferred path)
        Stored data is 0x00000001 or 1
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache#
        
        Scheduled TaskCache Change by Uncommon Program Sigma (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks#
        
        Scheduled Task Created by a Windows Script Elastic (inferred path)
        Suspicious Scheduled Task Registry Modification Elastic (inferred path)
        Remote Scheduled Task Creation Elastic (inferred path)
        Scheduled Task Created - Registry Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree#
        
        Windows Registry Delete Task SD Splunk (inferred path)
        Hide Schedule Task Via Index Value Tamper Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        Scheduled Task Hide Kusto (inferred path)
        Scheduled Task Created - Registry Sigma (inferred path)
        Diamond Sleet APT Scheduled Task Creation - Registry Sigma (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\WINDOWS#
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Application Experience\SdbinstMergeDbTask#
        
        Removal Of SD Value to Hide Schedule Task - Registry Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Shell\IndexerAutomaticMaintenance#
        
        Removal Of Index Value to Hide Schedule Task - Registry Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Windows Subsystem For Linux\AptPackageIndexUpdate#
        
        Removal Of Index Value to Hide Schedule Task - Registry Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\WINDOWS\WindowsAI#
        
        Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted Sigma (inferred branch)
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit#
        
        LSA Dump via SilentProcessExit Elastic (path prefix)
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\lsass.exe#
        
        Potential Credential Dumping Via LSASS SilentProcessExit Technique Sigma (inferred path)
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost#
        
        Suspicious Svchost Registry Modification Elastic (inferred path)
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore#
        
        Disabling SystemRestore In Registry Splunk (inferred branch)
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore#
        
        Registry Disable System Restore Sigma (inferred path)
        Stored data is DWORD (0x00000001)
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\SOFTWARE\Microsoft\Windows\CurrentVersion#
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\SOFTWARE\Microsoft\Windows\CurrentVersion\Run#
        
        Uncommon Registry Persistence Change Elastic (inferred path)
        Suspicious Registry Modification via WMI Elastic (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce#
        
        Uncommon Registry Persistence Change Elastic (inferred path)
        Suspicious Registry Modification via WMI Elastic (inferred path)
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\SCM\Regular#
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Tracing\SCM\Regular\TracingDisabled#value
        
        ETW Logging Disabled For SCM Sigma (inferred path)
        Stored data is DWORD (0x00000001)
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows#
        
        CurrentVersion NT Autorun Keys Modification Sigma (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs#value
        
        Registry Persistence via AppInit DLLs Modification Kusto (inferred path)
        New DLL Added to AppInit_DLLs Registry Key Sigma (inferred path) Path reference
        Registry Persistence via AppInit DLL Elastic (inferred path)
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon#
        
        Add DefaultUser And Password In Registry Splunk (inferred path)
        Values: DefaultPassword or DefaultUserName
        Uncommon Persistence via Registry Modification Elastic (inferred path)
        Winlogon Notify Key Logon Persistence Sigma (inferred branch)
        Registry Run Keys - Suspicious Registry Run Keys Kusto (inferred path)
        CurrentVersion NT Autorun Keys Modification Sigma (inferred path)
        Hide User Account From Sign-In Screen Splunk (inferred branch)
        Hiding User Account Via SpecialAccounts Registry Key Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
        Startup Persistence by a Low Reputation Process Elastic (inferred path)
        Potential Persistence Via Mpnotify Sigma (inferred branch)
        Winlogon AllowMultipleTSSessions Enable Sigma (inferred branch)
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon#value
        
        Auto Admin Logon Registry Entry Splunk (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword#
        
        AutoLogons Access Attempt via Registry Elastic
        HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify#
        
        Suspicious Windows Authentication Registry Modification Elastic (path prefix)
        HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell#
        
        Startup or Run Key Registry Modification Elastic (path prefix)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell#value
        
        Persistence via a Process from a Removable or Mounted ISO Device Elastic (inferred path)
        Startup Persistence from a Browser or Compression Utility Descendant Elastic (inferred path)
        Dual Persistence via Startup and Scheduled Task Elastic (inferred path)
        Potential KamiKakaBot Activity - Winlogon Shell Persistence Sigma (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ShellPrograms#
        
        Detect Registry Run Key Creation/Modification Kusto (inferred path)
        
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ShellPrograms\ShellAppRuntime.exe#
        
        Detect Registry Run Key Creation/Modification Kusto (inferred path)
        HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit#value
        
        Persistence via a Process from a Removable or Mounted ISO Device Elastic (inferred path)
        Startup Persistence from a Browser or Compression Utility Descendant Elastic (inferred path)
        Dual Persistence via Startup and Scheduled Task Elastic (inferred path)
      - HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WUDF\Services#
        
        PowerShell as a Service in Registry Sigma (inferred path)
    - HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices#
      
      Windows Process Executed From Removable Media Splunk (path prefix)
      Stored data is *:\*
      Windows WPDBusEnum Registry Key Modification Splunk (path prefix)
    - HKLM\SOFTWARE\Microsoft\WINDOWS SEARCH\Gather\WINDOWS\SystemIndex\Protocols#
      
      Forest Blizzard APT - Custom Protocol Handler Creation Sigma (inferred branch)
      Stored data is {026CC6D7-34B2-33D5-B551-CA31EB6CE345}
    - HKLM\SOFTWARE\Microsoft\WindowsUpdate\Orchestrator\USOShared\RegPathsInHKLMToDump#
      
      VBScript Payload Stored in Registry Sigma (inferred path)
  - HKLM\software\NetWire#
    
    Potential NetWire RAT Activity - Registry Sigma (inferred path)
  - HKLM\SOFTWARE\ODBC\ODBCINST.INI\SQL Server#
    - HKLM\SOFTWARE\ODBC\ODBCINST.INI\SQL Server\Driver#value
      
      Potentially Suspicious ODBC Driver Registered Sigma (inferred path)
      New ODBC Driver Registered Sigma (inferred path)
    - HKLM\SOFTWARE\ODBC\ODBCINST.INI\SQL Server\Setup#value
      
      Potentially Suspicious ODBC Driver Registered Sigma (inferred path)
  - HKLM\SOFTWARE\Policies\Microsoft#
    
    Suspicious Browser Files Modification Elastic (inferred branch)
    Disable Exploit Guard Network Protection on Windows Defender Sigma (inferred branch)
    Stored data is DWORD (00000001)
    Windows Modify Registry Disable WinDefender Notifications Splunk (inferred branch)
    Stored data is 0x00000001
    Windows Impair Defense Disable Win Defender App Guard Splunk (inferred branch)
    Stored data is 0x00000000
    Windows Modify Registry Configure BitLocker Splunk (inferred branch)
    Disable Windows Firewall by Registry Sigma (inferred branch)
    Stored data is DWORD (0x00000000)
    - HKLM\SOFTWARE\Policies\Microsoft\MRT#
      - HKLM\SOFTWARE\Policies\Microsoft\MRT\DontReportInfectionInformation#value
        
        Windows Impair Defense Disable Win Defender Report Infection Splunk (inferred path) Path reference
        Stored data is 0x00000001
    - HKLM\SOFTWARE\Policies\Microsoft\PowerShellCore\ScriptBlockLogging#
      - HKLM\SOFTWARE\Policies\Microsoft\PowerShellCore\ScriptBlockLogging\EnableScriptBlockLogging#value
        
        PowerShell Logging Disabled Via Registry Key Tampering Sigma (documented path) Path reference
        Stored data is DWORD (0x00000000)
        PowerShell Script Block Logging Disabled Elastic (documented path) Path reference
        Stored data is 0 or 0x00000000
    - HKLM\SOFTWARE\Policies\Microsoft\Windows#
      
      Windows Modify Registry USeWuServer Splunk (inferred branch)
      Stored data is 0x00000001
      Windows Modify Registry Do Not Connect To Win Update Splunk (inferred branch)
      Stored data is 0x00000001
      Windows Modify Registry Auto Minor Updates Splunk (inferred branch)
      Stored data is 0x00000000
      Disabling Windows Local Security Authority Defences via Registry Splunk (inferred branch)
      PowerShell Script Execution Policy Enabled Sigma (inferred branch)
      Stored data is DWORD (0x00000001)
      Windows Modify Registry No Auto Reboot With Logon User Splunk (inferred branch)
      Stored data is 0x00000001
      Windows Impair Defense Deny Security Software With Applocker Splunk (inferred branch)
      Stored data is *Action\="Deny"*
      Windows Modify Registry Auto Update Notif Splunk (inferred branch)
      Stored data is 0x00000002
      Disable Privacy Settings Experience in Registry Sigma (inferred branch)
      Stored data is DWORD (0x00000000)
      Disable Internal Tools or Feature in Registry Chronicle (inferred path)
      Windows Modify Registry No Auto Update Splunk (inferred branch)
      Stored data is 0x00000001
      Windows Modify Registry UpdateServiceUrlAlternate Splunk (inferred branch)
      Endpoint Security Evasion via Malicious AppLocker Deny Rules Elastic (inferred branch)
      Scripted Diagnostics Turn Off Check Enabled - Registry Sigma (inferred branch)
      Stored data is DWORD (0x00000001)
      Windows Modify Registry WuServer Splunk (inferred branch)
      Windows Modify Registry wuStatusServer Splunk (inferred branch)
      Windows Recall Feature Enabled - Registry Sigma (inferred branch)
      Stored data is DWORD (0x00000000)
      - HKLM\SOFTWARE\Policies\Microsoft\Windows\AppInstaller#
        
        HKLM\SOFTWARE\Policies\Microsoft\Windows\AppInstaller\EnableLocalManifestFiles#value
        
        Enable Local Manifest Installation With Winget Sigma (inferred path) Path reference
        Stored data is DWORD (0x00000001)
      - HKLM\SOFTWARE\Policies\Microsoft\WINDOWS\Appx#
        
        Potential Signing Bypass Via Windows Developer Features - Registry Sigma (inferred path)
        Values: AllowAllTrustedApps or AllowDevelopmentWithoutDevLicense
        Stored data is DWORD (0x00000001)
      - HKLM\SOFTWARE\Policies\Microsoft\WINDOWS\Explorer#
        
        HKLM\SOFTWARE\Policies\Microsoft\WINDOWS\Explorer\DisableNotificationCenter#value
        
        Windows Disable Notification Center Splunk (inferred path)
        Disable Internal Tools or Feature in Registry Sigma (inferred path)
      - HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging#
        
        HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\EnableScriptBlockLogging#value
        
        PowerShell Logging Disabled Via Registry Key Tampering Sigma (documented path) Path reference
        Stored data is DWORD (0x00000000)
        PowerShell Script Block Logging Disabled Elastic (documented path) Path reference
        Stored data is 0 or 0x00000000
      - HKLM\SOFTWARE\Policies\Microsoft\Windows\System#
        
        Disabling CMD Application Splunk (inferred branch)
        Windows Impair Defense Set Win Defender Smart Screen Level To Warn Splunk (inferred branch)
        Stored data is Warn
        
        HKLM\SOFTWARE\Policies\Microsoft\WINDOWS\SYSTEM\EnableSmartScreen#value
        
        Disable Windows SmartScreen Protection Splunk (inferred path)
        HKLM\Software\Policies\Microsoft\Windows\System\Scripts#
        
        System Scripts Autorun Keys Modification Sigma (inferred path)
        HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts#
        
        Uncommon Registry Persistence Change Elastic (inferred path)
        Suspicious Registry Modification via WMI Elastic (inferred path)
      - HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate#
        
        Detect Windows Update Disabled from Registry Kusto (inferred path)
        
        HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU#
        
        Detect Windows Update Disabled from Registry Kusto (inferred path)
    - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender#
      
      Windows Impair Defense Delete Win Defender Profile Registry Splunk (inferred path)
      Disable Defender MpEngine Registry Splunk (inferred branch)
      Windows Defender Exclusion Registry Entry Splunk (inferred branch)
      Activate Suppression of Windows Security Center Notifications Sigma (inferred branch)
      Stored data is DWORD (0x00000001)
      Windows Impair Defense Configure App Install Control Splunk (inferred branch)
      Disable Windows Defender Functionalities Via Registry Keys Sigma (inferred path)
      Microsoft Windows Defender Tampering Elastic (inferred path)
      Windows Defender Exclusions by Extension Elastic (inferred branch)
      Stored data is 0
      Disable Windows Behavior Monitoring Splunk (inferred branch)
      - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware#value
        
        Disable Defender AntiVirus Registry Splunk (inferred path)
        Windows Defender Disabled via Registry Modification Elastic (inferred path)
        Windows DisableAntiSpyware Registry Splunk (inferred path)
        Stored data is 0x00000001
      - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiVirus#value
        
        Disable Defender AntiVirus Registry Splunk (inferred path)
      - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions#
        
        Windows Defender Exclusions by Extension Elastic (path prefix)
        Stored data is 0
      - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\PUAProtection#value
        
        Disable PUA Protection on Windows Defender Sigma (inferred path)
        Stored data is DWORD (0x00000000)
      - HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\ServiceKeepAlive#value
        
        Windows Impair Defense Change Win Defender Health Check Intervals Splunk (inferred path)
        Stored data is 0x00000001
    - HKLM\SOFTWARE\Policies\Microsoft\Windows NT#
      
      Disabling SystemRestore In Registry Splunk (inferred branch)
      - HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Rpc#
        
        HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Rpc\ExtErrorInformation#value
        
        ETW Logging Disabled For rpcrt4.dll Sigma (inferred path) Path reference
      - HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore#
        
        Registry Disable System Restore Sigma (inferred path)
        Stored data is DWORD (0x00000001)
      - HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services#
        
        Windows Modify Registry DisableRemoteDesktopAntiAlias Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Modify Registry DisableSecuritySettings Splunk (inferred branch)
        Stored data is 0x00000001
        RDP Sensitive Settings Changed to Zero Chronicle (inferred path)
        Values: fSingleSessionPerUser or UserAuthentication
        RDP Sensitive Settings Changed Chronicle (inferred branch)
        
        HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client#
        
        RDP Sensitive Settings Changed Chronicle (inferred path)
        
        HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client\UsbBlockDeviceBySetupClasses#
        HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Client\UsbSelectDeviceByInterfaces#
        
        RDP Sensitive Settings Changed Chronicle (inferred path)
        HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Shadow#value
        
        Potential Remote Desktop Shadowing Activity Elastic (inferred path)
      - HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services#
        
        RDP shadow session configuration enabled (registry) Sigma (inferred path)
  - HKLM\Software\Remcos#
    
    Remcos client registry install entry Splunk (inferred path)
  - HKLM\SOFTWARE\WOW6432Node#
    - HKLM\Software\Wow6432Node\Classes#
      - HKLM\Software\Wow6432Node\Classes\AllFileSystemObjects\ShellEx\DragDropHandlers#
        
        Wow6432Node Classes Autorun Keys Modification Sigma (inferred path)
      - HKLM\Software\Wow6432Node\Classes\CLSID#
        
        HKLM\Software\Wow6432Node\Classes\CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance#
        
        Wow6432Node Classes Autorun Keys Modification Sigma (inferred path)
        HKLM\Software\Wow6432Node\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance#
        
        Wow6432Node Classes Autorun Keys Modification Sigma (inferred path)
    - HKLM\Software\Wow6432Node\Classes#
      
      Wow6432Node Classes Autorun Keys Modification Sigma (inferred path)
    - HKLM\SOFTWARE\WOW6432Node\Facebook_Assistant#
      
      Revil Registry Entry Splunk (inferred path)
    - HKLM\Software\Wow6432Node\Google\Chrome\Extensions#
      
      Running Chrome VPN Extensions via the Registry 2 VPN Extension Sigma (inferred path)
    - HKLM\SOFTWARE\WOW6432Node\Microsoft#
      
      Windows Installer with Suspicious Properties Elastic (inferred path)
      - HKLM\SOFTWARE\WOW6432Node\Microsoft\.NETFramework#
        
        Potential Registry Persistence Attempt Via DbgManagedDebugger Sigma (inferred branch)
      - HKLM\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components#
        
        Common Autorun Keys Modification Sigma (inferred path)
      - HKLM\SOFTWARE\WOW6432Node\Microsoft\AMSI#
        
        Removal Of AMSI Provider Registry Keys Sigma (inferred path)
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\AMSI\Providers\{2781761E-28E0-4109-99FE-B9D127C57AFE}#
        
        Potential Persistence Via New AMSI Providers - Registry Sigma (inferred path)
      - HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography#
        
        Windows Registry SIP Provider Modification Splunk (inferred branch)
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID#
        
        Persistence Via New SIP Provider Sigma (inferred path)
        Suspicious SIP or trust provider registration Sigma (inferred path)
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0#
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\$DLL#value
        
        Windows Registry SIP Provider Modification Splunk (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg#
        
        SIP Provider Modification Elastic (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1#
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\$DLL#value
        
        Windows Registry SIP Provider Modification Splunk (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers#
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Dll#value
        
        Windows Registry SIP Provider Modification Splunk (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust#
        
        Persistence Via New SIP Provider Sigma (inferred path)
        Suspicious SIP or trust provider registration Sigma (inferred path)
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy#
        
        SIP Provider Modification Elastic (inferred path)
      - HKLM\SOFTWARE\WOW6432Node\Microsoft\Edge#
        
        Windows Impair Defense Override SmartScreen Prompt Splunk (inferred branch)
        Stored data is 0x00000000
      - HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate#
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState#
        
        Remote MSI Package Installation via MSIEXEC Elastic (inferred path)
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}#
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\eulaaccepted#value
        
        PUA - Sysinternal Tool Execution - Registry Sigma (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\eulaaccepted#value
        
        PUA - Sysinternal Tool Execution - Registry Sigma (inferred path)
      - HKLM\Software\WOW6432Node\Microsoft\HtmlHelp Author\Location#
        
        Potential Persistence Via CHM Helper DLL Sigma (inferred path)
      - HKLM\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\Environment#
        
        Logon Script Event Trigger Execution Splunk (inferred branch)
        NET Profiler UAC bypass Splunk (inferred branch)
        Stored data is *.dll
        Privilege Escalation via Windir Environment Variable Elastic (inferred branch)
        Suspicious Environment Variable Has Been Registered Sigma (inferred path)
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\Environment\Production#
        
        Windows Anomalous Registry Value Length in Environment Key Splunk (inferred path)
      - HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer#
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\JAVA_VM\CONSOLE#
        
        Windows Modify Registry ValleyRAT C2 Config Splunk (inferred branch)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation\{2781761E-28E0-4109-99FE-B9D127C57AFE}#
        
        Removal Of AMSI Provider Registry Keys Sigma (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main#
        
        Internet Explorer DisableFirstRunCustomize Enabled Sigma (inferred branch)
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Extensions Off Page#value
        
        Internet Explorer Autorun Keys Modification Sigma (inferred path)
      - HKLM\SOFTWARE\WOW6432Node\Microsoft\Jet\4.0\Engines\Excel#
        
        Enable Microsoft Dynamic Data Exchange Sigma (inferred branch)
      - HKLM\SOFTWARE\WOW6432Node\Microsoft\Security Center#
        
        UAC Notification Disabled Sigma (inferred branch)
        Stored data is DWORD (0x00000001)
      - HKLM\SOFTWARE\WOW6432Node\Microsoft\Software\Microsoft\Shared Tools#
        
        Windows Modify Registry Qakbot Binary Data Registry Splunk (inferred path)
      - HKLM\SOFTWARE\WOW6432Node\Microsoft\Terminal Server Client#
        
        Windows Modify Registry AuthenticationLevelOverride Splunk (inferred branch)
        Stored data is 0x00000000
        Terminal Server Client Connection History Cleared - Registry Sigma (inferred branch)
        Windows RDP Server Registry Entry Created Splunk (inferred branch)
        Windows RDP Server Registry Deletion Splunk (inferred branch)
      - HKLM\SOFTWARE\WOW6432Node\Microsoft\WBEM\CIMOM#
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\WBEM\CIMOM\AllowAnonymousCallback#value
        
        Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback Sigma (inferred path)
        Stored data is DWORD (0x00000001)
      - HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion#
        
        Registry Keys Used For Persistence Splunk (inferred path)
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags#
        
        Registry Keys for Creating SHIM Databases Splunk (inferred branch)
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom#
        
        Registry Keys for Creating SHIM Databases Splunk (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32#
        
        Wow6432Node Windows NT CurrentVersion Autorun Keys Modification Sigma (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Event Viewer#
        
        Potential Persistence Via Event Viewer Events.asp Sigma (inferred path)
        Values: MicrosoftRedirectionProgram or MicrosoftRedirectionProgramCommandLineParameters or MicrosoftRedirectionURL
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini\Windows#
        
        Wow6432Node Windows NT CurrentVersion Autorun Keys Modification Sigma (inferred path)
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\IniFileMapping\win.ini\Windows\APPINIT_DLLS#value
        
        Wow6432Node Windows NT CurrentVersion Autorun Keys Modification Sigma (inferred path)
        Registry Persistence via AppInit DLL Elastic (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree#
        
        Windows Registry Delete Task SD Splunk (inferred path)
        Scheduled Task Hide Kusto (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows#
        
        Wow6432Node Windows NT CurrentVersion Autorun Keys Modification Sigma (inferred path)
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs#value
        
        New DLL Added to AppInit_DLLs Registry Key Sigma (inferred path) Path reference
        Registry Persistence via AppInit DLLs Modification Kusto (inferred path)
        Wow6432Node Windows NT CurrentVersion Autorun Keys Modification Sigma (inferred path)
        Registry Persistence via AppInit DLL Elastic (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon#
        
        Hide User Account From Sign-In Screen Splunk (inferred branch)
        Winlogon AllowMultipleTSSessions Enable Sigma (inferred branch)
        Registry Run Keys - Suspicious Registry Run Keys Kusto (inferred path)
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName#value
        
        Add DefaultUser And Password In Registry Splunk (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell#value
        
        Potential KamiKakaBot Activity - Winlogon Shell Persistence Sigma (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\WUDF\Services\SensorsCx0102#
        
        PowerShell as a Service in Registry Sigma (inferred path)
      - HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion#
        
        Registry Run Keys - Suspicious Registry Run Keys Kusto (inferred path)
        Registry Keys Used For Persistence Splunk (inferred path)
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\AppHost#
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\AppHost\EnableWebContentEvaluation#value
        
        Windows Impair Defense Disable Web Evaluation Splunk (inferred path)
        Stored data is 0 or 0x00000000
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer#
        
        Potentially Suspicious Command Executed Via Run Dialog Box - Registry Sigma (inferred branch)
        Command Executed Via Run Dialog Box - Registry Sigma (inferred branch)
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects#
        
        Wow6432Node CurrentVersion Autorun Keys Modification Sigma (inferred path)
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}#
        
        Wow6432Node CurrentVersion Autorun Keys Modification Sigma (inferred path)
        Values: (Default) or NoExplorer
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer#
        
        Potential Persistence Via MyComputer Registry Keys Sigma (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers#
        
        Wow6432Node CurrentVersion Autorun Keys Modification Sigma (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects#
        
        Wow6432Node CurrentVersion Autorun Keys Modification Sigma (inferred path)
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A}#
        
        COM Registry Key Modified to Point to File in Color Profile Folder Kusto (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ImmersiveShell#
        
        Windows Modify Registry Disable Windows Security Center Notif Splunk (inferred branch)
        Stored data is 0x00000000
        Disable Windows Security Center Notifications Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings#
        
        Registry Modification from a Potentially Altered Call Stack Elastic (inferred path)
        Potential Hardware Breakpoints Evasion Elastic (inferred path)
        
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults#
        
        IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Sigma (inferred path)
        Values: http or https
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\MicrosoftEdge#
        
        Windows Impair Defense Overide Win Defender Phishing Filter Splunk (inferred branch)
        Stored data is 0x00000000
        HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run#
        
        Registry or File Modification from Suspicious Memory Elastic (inferred path)
        Suspicious String Value Written to Registry Run Key Elastic (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run#
        
        Registry Run Key Prefixed with Asterisk Elastic (inferred branch)
        Persistence via Hidden Run Key Detected Elastic (inferred path)
        Script Interpreter Process Writing to Commonly Abused Persistence Locations Elastic (inferred branch)
        New RUN Key Pointing to Suspicious Folder Chronicle (inferred path)
        Registry Run Key Modified by Unusual Process Elastic (inferred branch)
        Suspicious String Value Written to Registry Run Key Elastic (inferred path)
        New RUN Key Pointing to Suspicious Folder Sigma (inferred path)
        Suspicious Powershell In Registry Run Keys Chronicle (inferred path)
        Suspicious PowerShell In Registry Run Keys Sigma (inferred path)
        Untrusted Process Writing to Commonly Abused Persistence Locations Elastic (inferred branch)
        Startup Persistence from Backed RWX Memory Elastic (inferred branch)
        Detect Remote Access Software Usage Registry Splunk (inferred path)
        Suspicious Startup Persistence via a Windows Installer Elastic (inferred branch)
        Persistence via a Windows Installer Elastic (inferred branch)
        Potential REMCOS Trojan Execution Elastic (inferred path)
        Values: Remcos or Rmc-??????
        HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run#
        
        Suspicious Run Key from Download Sigma (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce#
        
        Registry Run Key Prefixed with Asterisk Elastic (inferred branch)
        Script Interpreter Process Writing to Commonly Abused Persistence Locations Elastic (inferred branch)
        New RUN Key Pointing to Suspicious Folder Sigma (inferred path)
        Suspicious Powershell In Registry Run Keys Chronicle (inferred path)
        Suspicious PowerShell In Registry Run Keys Sigma (inferred path)
        Detect Remote Access Software Usage Registry Splunk (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad#
        
        Wow6432Node CurrentVersion Autorun Keys Modification Sigma (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall#
        
        Remote MSI Package Installation via MSIEXEC Elastic (inferred path)
        HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Winevt\Publishers#
        
        Sysmon Channel Reference Deletion Sigma (inferred branch)
    - HKLM\SOFTWARE\WOW6432Node\Sophos\SAVService\TamperProtection#
      - HKLM\SOFTWARE\WOW6432Node\Sophos\SAVService\TamperProtection\Enabled#value
        
        Tamper With Sophos AV Registry Keys Sigma (inferred path) Path reference
        Stored data is DWORD (0x00000000)
- HKLM\SYSTEM#
  - HKLM\SYSTEM\ControlSet001#
    
    Windows Installer with Suspicious Properties Elastic (inferred path)
    - HKLM\SYSTEM\ControlSet001\Control#
      
      CurrentControlSet Autorun Keys Modification Chronicle (inferred path)
      Kernel Driver Registered via NtLoadDriver Elastic (inferred path)
      Stored data is 1
      ETW Logging Disabled In .NET Processes - Registry Sigma (inferred branch)
      Potential CobaltStrike Service Installations - Registry Sigma (inferred path)
      Suspicious Remote Registry Modification Elastic (inferred path)
      Uncommon Registry Persistence Change Elastic (inferred path)
      Windows Registry Dotnet ETW Disabled Via ENV Variable Splunk (inferred branch)
      Disable Internal Tools or Feature in Registry Chronicle (inferred path)
      - HKLM\SYSTEM\ControlSet001\Control\CI#
        
        Attempt to Disable Driver via HVCIDisallowedImages Elastic (inferred branch)
        
        HKLM\SYSTEM\ControlSet001\Control\CI\Config#
        
        HKLM\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable#value
        
        Windows Vulnerable Driver Blocklist Disabled Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        Attempt to Disable Windows Driver Blocklist via Registry Elastic (inferred path)
        Stored data is 0
      - HKLM\SYSTEM\ControlSet001\Control\CI#
        
        Driver Added To Disallowed Images In HVCI - Registry Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Control\CloudDomainJoin\JoinInfo#
        
        Microsoft Entra ID Local Device Join Information and Transport Key Registry Keys Access Kusto
      - HKLM\SYSTEM\ControlSet001\Control\CommonGlobUserSettings\Control Panel\Desktop#
        
        Screensaver Event Trigger Execution Splunk (inferred branch)
        ScreenSaver Registry Key Set Sigma (inferred branch)
      - HKLM\SYSTEM\ControlSet001\Control\ComputerName\ComputerName#
        
        HKLM\SYSTEM\ControlSet001\Control\ComputerName\ComputerName\ComputerName#value
        
        Potential DANTE Spyware Execution Elastic (inferred path)
      - HKLM\SYSTEM\ControlSet001\Control\ContentIndex\Language#
        
        HKLM\SYSTEM\ControlSet001\Control\ContentIndex\Language\English_UK#
        
        Potential Persistence Via DLLPathOverride Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\ContentIndex\Language\English_US#
        HKLM\SYSTEM\ControlSet001\Control\ContentIndex\Language\Neutral#
        
        Potential Persistence Via DLLPathOverride Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Control\CrashControl#
        
        CrashControl CrashDump Disabled Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        System crash behavior manipulation - WMImplant (registry) Sigma (inferred path)
        Values: AutoReboot or DumpFile or LogEvent
        
        HKLM\SYSTEM\ControlSet001\Control\CrashControl\CrashDumpEnabled#value
        
        Windows Disable Memory Crash Dump Splunk (inferred path)
        Stored data is 0x00000000
        CrashDump Disabled via Registry Modification Elastic (inferred path)
        Stored data is 0
        System crash behavior manipulation - WMImplant (registry) Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\CrashControl\KernelDumpOnly#
        
        System crash behavior manipulation - WMImplant (registry) Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\CrashControl\MiniDumpDir#
        HKLM\SYSTEM\ControlSet001\Control\CrashControl\Overwrite#
        HKLM\SYSTEM\ControlSet001\Control\CrashControl\SendAlert#
        
        System crash behavior manipulation - WMImplant (registry) Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Control\Cryptography\Ngc\KeyTransportKey#
        
        Microsoft Entra ID Local Device Join Information and Transport Key Registry Keys Access Kusto (inferred path)
      - HKLM\SYSTEM\ControlSet001\Control\DeviceGuard#
        
        HKLM\SYSTEM\ControlSet001\Control\DeviceGuard\DisableHypervisorEnforcedPagingTranslation#value
        
        Hypervisor Enforced Paging Translation Disabled Sigma (inferred path) Path reference
        Stored data is DWORD (0x00000001)
        HKLM\SYSTEM\ControlSet001\Control\DeviceGuard\HypervisorEnforcedCodeIntegrity#value
        
        Windows Hypervisor Enforced Code Integrity Disabled Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        Disabling Hypervisor-protected Code Integrity via Registry Elastic (inferred path)
        Stored data is 0
        HKLM\SYSTEM\ControlSet001\Control\DeviceGuard\Scenarios#
        
        Windows Impair Defenses Disable HVCI Splunk (inferred branch)
        Stored data is 0x00000000
        Windows Hypervisor Enforced Code Integrity Disabled Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
        Disabling Hypervisor-protected Code Integrity via Registry Elastic (inferred branch)
        Stored data is 0
      - HKLM\SYSTEM\ControlSet001\Control\ELS\Services#
        
        DHCP Callout DLL Installation Sigma (inferred branch)
      - HKLM\SYSTEM\ControlSet001\Control\FileSystem#
        
        HKLM\SYSTEM\ControlSet001\Control\FileSystem\LongPathsEnabled#value
        
        Windows Modify Registry LongPathsEnabled Splunk (inferred path)
        Stored data is 0x00000001
        Blackbyte Ransomware Registry Sigma (inferred path)
        Stored data is DWORD (0x00000001)
      - HKLM\SYSTEM\ControlSet001\Control\Keyboard Layouts#
        
        Suspicious Path In Keyboard Layout IME File Registry Value Sigma (inferred path)
        Uncommon Extension In Keyboard Layout IME File Registry Value Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Control\Lsa#
        
        NetNTLM Downgrade Attack - Registry Sigma (inferred path)
        CurrentControlSet Autorun Keys Modification Sigma (inferred path)
        Windows Audit Policy Auditing Option Modified - Registry Splunk (inferred path)
        Values: auditbasedirectories or auditbaseobjects or crashonauditfail or fullprivilegeauditing
        System BootKey Registry Access Elastic (inferred branch)
        Backdoor introduction via registry permission change through WMI (DAMP) Sigma
        Windows Credential Guard Related Registry Value Deleted - Registry Sigma (inferred branch)
        Suspicious Windows Authentication Registry Modification Elastic (inferred path)
        
        HKLM\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages#value
        
        Potential LSA Authentication Package Abuse Elastic (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\lsa\Data#
        
        SysKey Registry Keys Access Sigma (inferred path)
        HKLM\System\ControlSet001\Control\Lsa\DisableRestrictedAdmin#
        
        RestrictedAdminMode Registry Value Tampering Chronicle (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Lsa\DisableRestrictedAdmin#value
        
        Windows Modify Registry Disable Restricted Admin Splunk (inferred path)
        RestrictedAdminMode Registry Value Tampering Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Lsa\dsrmAdminLogonBehavior#value
        
        DSRM Account Abuse Kusto (inferred path)
        Windows AD DSRM Account Changes Splunk (inferred path)
        Stored data is *1 or *2
        Directory Service Restore Mode(DSRM) Registry Value Tampering Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\lsa\GBG#
        
        SysKey Registry Keys Access Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Lsa\JD#
        
        System BootKey Registry Access Elastic (inferred path)
        
        HKLM\SYSTEM\ControlSet001\Control\Lsa\JD\Lookup#value
        
        System BootKey Registry Access Elastic (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\lsa\JD#
        
        SysKey Registry Keys Access Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Lsa\LmCompatibilityLevel#value
        
        Potential NetNTLMv1 Downgrade Attack Elastic Endpoint behavior rule (inferred path)
        NetNTLM Downgrade Attack Sigma (inferred path)
        NTLM downgrade attack (Reg via SYSMON) Sigma (inferred path)
        Potential NetNTLMv1 Downgrade Attack Elastic Detection rule (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Lsa\LsaCfgFlags#value
        
        Disabling Windows Local Security Authority Defences via Registry Splunk (inferred path)
        Windows Credential Guard Disabled - Registry Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        HKLM\SYSTEM\ControlSet001\Control\Lsa\MSV1_0#
        
        NetNTLM Downgrade Attack Sigma (inferred path)
        Values: NtlmMinClientSec or RestrictSendingNTLMTraffic
        HKLM\SYSTEM\ControlSet001\Control\Lsa\NoLmHash#value
        
        Enable LM Hash Storage Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        Windows LSA Secrets NoLMhash Registry Splunk (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Lsa\OSConfig#
        
        HKLM\SYSTEM\ControlSet001\Control\Lsa\OSConfig\Security Packages#value
        
        Security Support Provider (SSP) Added to LSA Configuration Sigma (inferred path)
        Installation of Security Support Provider Elastic (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL#value
        
        Disabling Lsa Protection via Registry Modification Elastic (inferred path)
        Disabling Windows Local Security Authority Defences via Registry Splunk (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Lsa\Security Packages#value
        
        Installation of Security Support Provider Elastic (inferred path)
        Security Support Provider (SSP) Added to LSA Configuration Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Lsa\Skew1#
        
        System BootKey Registry Access Elastic (inferred path)
        
        HKLM\SYSTEM\ControlSet001\Control\Lsa\Skew1\SkewMatrix#value
        
        System BootKey Registry Access Elastic (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\lsa\Skew1#
        
        SysKey Registry Keys Access Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Control\LsaExtensionConfig\LsaSrv#
        
        HKLM\SYSTEM\ControlSet001\Control\LsaExtensionConfig\LsaSrv\Extensions#value
        
        Potential Persistence Via LSA Extensions Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Control\ManufacturingMode\Default\Services#
        
        SolarWinds Process Disabling Services via Registry Elastic (inferred path)
        Stored data is 0x00000004 or 4
        Service Disabled via Registry Modification Elastic (inferred path)
      - HKLM\SYSTEM\ControlSet001\Control\Network#
        
        Potential PlugX Registry Modification Elastic (inferred branch)
      - HKLM\SYSTEM\ControlSet001\Control\NetworkProvider\Order#
        
        CurrentControlSet Autorun Keys Modification Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Control\NetworkSetup2\Protocols#
        
        Forest Blizzard APT - Custom Protocol Handler Creation Sigma (inferred branch)
        Stored data is {026CC6D7-34B2-33D5-B551-CA31EB6CE345}
      - HKLM\SYSTEM\ControlSet001\Control\Print#
        
        HKLM\SYSTEM\ControlSet001\Control\Print\Environments#
        
        Detect Print Processors Registry Driver Key Creation/Modification Kusto (inferred path)
        
        HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows#
        
        PrinterNightmare Mimikatz Driver Name Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows ARM64\Print Processors\winprint#
        
        Potential Port Monitor or Print Processor Registration Abuse Elastic (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64#
        
        HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Drivers#
        
        HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Drivers\Version-3#
        
        HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Drivers\Version-3\Microsoft enhanced Point and Print compatibility driver#
        
        HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Drivers\Version-3\Microsoft enhanced Point and Print compatibility driver\Manufacturer#value
        
        Suspicious Printer Driver Empty Manufacturer Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Drivers\Version-3\mimikatz#
        
        PrinterNightmare Mimikatz Driver Name Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Drivers\Version-3\QMS 810#
        
        PrinterNightmare Mimikatz Driver Name Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Drivers\Version-4\Microsoft Print To PDF#
        
        HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Drivers\Version-4\Microsoft Print To PDF\Manufacturer#value
        
        Suspicious Printer Driver Empty Manufacturer Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors#
        
        Print Processor Registry Autostart Splunk (inferred path)
        
        HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors\winprint#
        
        Potential Port Monitor or Print Processor Registration Abuse Elastic (inferred path)
        Print Processor Registry Autostart Splunk (inferred path)
        
        HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors\winprint\Driver#value
        
        Potential Port Monitor or Print Processor Registration Abuse Elastic (inferred path)
        Print Processor Registry Autostart Splunk (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Print\Environments#
        
        PrinterNightmare Mimikatz Driver Name Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Print\Monitors#
        
        Add Port Monitor Persistence in Registry Sigma (inferred path)
        Monitor Registry Keys for Print Monitors Splunk (inferred path)
        CurrentControlSet Autorun Keys Modification Sigma (inferred path)
        Potential Port Monitor or Print Processor Registration Abuse Elastic (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Print\Providers#
        
        CurrentControlSet Autorun Keys Modification Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Control\SafeBoot#
        
        CurrentControlSet Autorun Keys Modification Sigma (inferred path)
        
        HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Minimal#
        
        Registry Persistence via Service in Safe Mode Sigma (inferred path)
        Windows Registry Modification for Safe Mode Persistence Splunk (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\SafeBoot\Network#
        
        Registry Persistence via Service in Safe Mode Sigma (inferred path)
        Windows Registry Modification for Safe Mode Persistence Splunk (inferred path)
      - HKLM\SYSTEM\ControlSet001\Control\SecurePipeServers#
        
        Backdoor introduction via registry permission change through WMI (DAMP) Sigma
      - HKLM\SYSTEM\ControlSet001\Control\SecurityProviders#
        
        CurrentControlSet Autorun Keys Modification Sigma (inferred path)
        
        HKLM\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\Protocols#
        
        HKLM\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0#
        
        Old TLS1.0/TLS1.1 Protocol Version Enabled Sigma (inferred path)
        Stored data is DWORD (0x00000001)
        HKLM\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1#
        
        Old TLS1.0/TLS1.1 Protocol Version Enabled Sigma (inferred path)
        Stored data is DWORD (0x00000001)
        HKLM\SYSTEM\ControlSet001\Control\SecurityProviders\WDigest#
        
        Wdigest CredGuard Registry Modification Sigma (inferred path)
        Wdigest Enable UseLogonCredential Chronicle (inferred path)
        
        HKLM\SYSTEM\ControlSet001\Control\SecurityProviders\WDigest\UseLogonCredential#value
        
        Enable WDigest UseLogonCredential Registry Splunk (inferred path)
        Modification of WDigest Security Provider Elastic (inferred path)
        Stored data is 0x00000001 or 1
        WDigest downgrade attack Kusto (inferred path)
        Wdigest authentication enabled (registry) Sigma (inferred path)
        Wdigest Enable UseLogonCredential Sigma (inferred path)
        Stored data is DWORD (0x00000001)
      - HKLM\SYSTEM\ControlSet001\Control\Session Manager#
        
        Windows AppCertDLL Modification Via Registry Splunk (inferred branch)
        Registry Persistence via AppCert DLL Elastic (inferred branch)
        Registry Run Keys - Suspicious Registry Run Keys Kusto (inferred path)
        Session Manager Autorun Keys Modification Sigma (inferred path)
        Values: Execute or S0InitialCommand or SetupExecute or SetupExecuteNoPnpSync
        
        HKLM\SYSTEM\ControlSet001\Control\Session Manager\AllowProtectedRenames#value
        
        AllowProtectedRenames Registry Modification Elastic (inferred path)
        Stored data is 1
        HKLM\SYSTEM\ControlSet001\Control\Session Manager\AppCertDLLs#
        
        Registry Persistence via AppCert DLL Modification Kusto (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Session Manager\BootExecute#value
        
        Session Manager Autorun Keys Modification Sigma (inferred path)
        Windows Registry BootExecute Modification Splunk (inferred path)
        Suspicious BootExecute Registry Modification Elastic (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Session Manager\Configuration Manager#
        
        Periodic Backup For System Registry Hives Enabled Sigma (inferred branch)
        Stored data is DWORD (0x00000001)
        HKLM\SYSTEM\ControlSet001\Control\Session Manager\Environment#
        
        Enabling COR Profiler Environment Variables Sigma (inferred path) Path reference
        Python PYTHONPATH Modification During Package Installation Splunk (inferred path) Path reference
        Privilege Escalation via Windir Environment Variable Elastic (inferred branch)
        Windows Anomalous Registry Value Length in Environment Key Splunk (inferred path)
        Suspicious Environment Variable Has Been Registered Sigma (inferred path)
        Logon Script Event Trigger Execution Splunk (inferred branch)
        NET Profiler UAC bypass Splunk (inferred branch)
        Stored data is *.dll
        
        HKLM\SYSTEM\ControlSet001\Control\Session Manager\Environment\windir#value
        
        SilentCleanup UAC Bypass Splunk (inferred path)
        Stored data is *.exe*
        Bypass UAC Using SilentCleanup Task Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Session Manager\KnownDLLs#
        
        Session Manager Autorun Keys Modification Chronicle (inferred path)
        Session Manager Autorun Keys Modification Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Session Manager\PendingFileRenameOperations#value
        
        Potential PendingFileRenameOperations Tampering Sigma (inferred path)
        Potential Elastic Tampering via PendingFileRename Elastic (inferred path)
      - HKLM\SYSTEM\ControlSet001\Control\Terminal Server#
        
        Windows Remote Services Allow Remote Assistance Splunk (inferred branch)
        Stored data is 0x00000001
        Allow RDP Remote Assistance Feature Sigma (inferred branch)
        Stored data is DWORD (0x00000001)
        RDP Sensitive Settings Changed Chronicle (inferred path)
        
        HKLM\SYSTEM\ControlSet001\Control\Terminal Server\DefaultUserConfiguration#
        
        HKLM\SYSTEM\ControlSet001\Control\Terminal Server\DefaultUserConfiguration\Shadow#value
        
        RDP Sensitive Settings Changed Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Terminal Server\fDenyTSConnections#value
        
        Windows Remote Services Rdp Enable Splunk (inferred path)
        Stored data is 0x00000000
        RDP Enabled via Registry Elastic (inferred path)
        Stored data is 0 or 0x00000000
        RDP Sensitive Settings Changed to Zero Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        Windows Modify Registry Disable RDP Splunk (inferred path)
        Stored data is 0x00000001
        RDP Sensitive Settings Changed to Zero Chronicle (inferred path) Path reference
        HKLM\SYSTEM\ControlSet001\Control\Terminal Server\fSingleSessionPerUser#value
        
        RDP Sensitive Settings Changed to Zero Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        HKLM\SYSTEM\ControlSet001\Control\Terminal Server\Wds\rdpwd#
        
        CurrentControlSet Autorun Keys Modification Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Terminal Server\WinStations#
        
        HKLM\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\Console#
        
        Windows Modify Registry ValleyRAT C2 Config Splunk (inferred branch)
        
        HKLM\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\Console\Shadow#value
        
        RDP Sensitive Settings Changed Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\RDP-Tcp#
        
        CurrentControlSet Autorun Keys Modification Sigma (inferred path)
        RDP Sensitive Settings Changed Chronicle (inferred branch)
        RDP Sensitive Settings Changed Sigma (inferred path)
        Values: InitialProgram or SecurityLayer or Shadow
        
        HKLM\SYSTEM\ControlSet001\control\terminal server\winstations\rdp-tcp\portnumber#
        
        Default RDP Port Changed to Non Standard Port Chronicle (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber#value
        
        Enable RDP In Other Port Number Splunk (inferred path)
        Default RDP Port Changed to Non Standard Port Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\RDP-Tcp\UserAuthentication#value
        
        Network-Level Authentication (NLA) Disabled Elastic (inferred path)
        RDP Sensitive Settings Changed to Zero Sigma (inferred path)
        Stored data is DWORD (0x00000000)
      - HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger#
        
        Windows Impair Defenses Disable Auto Logger Session Splunk (inferred path)
        Stored data is 0x00000000
        
        HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderApiLogger#
        
        Potential AutoLogger Sessions Tampering Sigma (inferred path)
        
        HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderApiLogger\Start#value
        
        Windows Impair Defenses Disable Win Defender Auto Logging Splunk (inferred path)
        Stored data is 0x00000000
        Potential AutoLogger Sessions Tampering Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderAuditLogger#
        
        HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger\DefenderAuditLogger\Start#value
        
        Windows Impair Defenses Disable Win Defender Auto Logging Splunk (inferred path)
        Stored data is 0x00000000
        Potential AutoLogger Sessions Tampering Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger\EventLog-Application#
        
        HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger\EventLog-Application\Start#value
        
        Potential AutoLogger Sessions Tampering Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger\EventLog-Security#
        
        HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger\EventLog-Security\Start#value
        
        Potential AutoLogger Sessions Tampering Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger\EventLog-System#
        
        HKLM\SYSTEM\ControlSet001\Control\WMI\Autologger\EventLog-System\Start#value
        
        Potential AutoLogger Sessions Tampering Sigma (inferred path)
    - HKLM\SYSTEM\ControlSet001\Enum\USBSTOR#
      
      First Time Seen Removable Device Elastic (inferred path) Path reference
      - HKLM\SYSTEM\ControlSet001\Enum\USBSTOR\Disk&Ven_ASolid&Prod_USB&Rev_\17290406&0#
        
        HKLM\SYSTEM\ControlSet001\Enum\USBSTOR\Disk&Ven_ASolid&Prod_USB&Rev_\17290406&0\FriendlyName#value
        
        Windows USBSTOR Registry Key Modification Splunk (inferred path)
    - HKLM\SYSTEM\ControlSet001\Hardware Profiles#
      
      Windows Modify Registry With MD5 Reg Key Name Splunk (inferred path)
      Stored data is Binary Data
      - HKLM\SYSTEM\ControlSet001\Hardware Profiles\0001\System\CurrentControlSet\SERVICES#
        
        Potential CobaltStrike Service Installations - Registry Sigma (inferred path)
        Windows Service Deletion In Registry Splunk (inferred path)
        DHCP Callout DLL Installation Sigma (inferred branch)
    - HKLM\SYSTEM\ControlSet001\Services#
      
      ServiceDll Hijack Sigma (inferred path)
      Service Binary in User Controlled Folder Sigma (inferred path)
      Potential Credential Dumping Attempt Using New NetworkProvider - REG Sigma (inferred path)
      Suspicious ImagePath Service Creation Elastic (inferred path)
      Windows Service Configuration Hjack Elastic (inferred path)
      Service Binary in Suspicious Folder Sigma (inferred path)
      Unusual Persistence via Services Registry Elastic (inferred path)
      Suspicious Windows Service DLL Creation Elastic (inferred path)
      Self Service Persistence by an Unsigned Process Elastic (inferred path)
      Security Service Registry ACL Modification Kusto (inferred path)
      Service Registry Key Read Access Request Sigma (inferred path)
      Service Path Modification Elastic (inferred path)
      Windows Service Creation Using Registry Entry Splunk (inferred path)
      Potential Privilege Escalation via Service ImagePath Modification Elastic (inferred path)
      Unusual Windows System Service Disabled Elastic (inferred path)
      Suspicious Service ImagePath Value Elastic (inferred path)
      SolarWinds Process Disabling Services via Registry Elastic (inferred path)
      Stored data is 0x00000004 or 4
      Persistence via WMI Standard Registry Provider Elastic (inferred path)
      Potential CobaltStrike Service Installations - Registry Sigma (inferred path)
      Registry or File Modification from Suspicious Memory Elastic (inferred path)
      Suspicious Remote Registry Modification Elastic (inferred path)
      Windows Service Deletion In Registry Splunk (inferred path)
      DHCP Callout DLL Installation Sigma (inferred branch)
      PowerShell as a Service in Registry Sigma (inferred path)
      Sysmon Driver Altitude Change Sigma (inferred path)
      Detect Remote Access Software Usage Registry Splunk (inferred path)
      CVE-2023-23397 Exploitation Attempt Sigma (inferred path)
      Kernel Driver Registered via NtLoadDriver Elastic (inferred path)
      Stored data is 1
      Service Disabled via Registry Modification Elastic (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\bam\State\UserSettings\S-1-5-18#
        
        Executable Running as NT AUTHORITY_SYSTEM Registered in BAM (Sysmon) Splunk (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\BFE\Parameters\Policy\Persistent\Filter#
        
        WFP Filter Added via Registry Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\BTOBTO#
        
        Impacket SMBexec service creation (registry) Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\EventLog#
        
        HKLM\SYSTEM\ControlSet001\Services\EventLog\Application#
        
        HKLM\SYSTEM\ControlSet001\Services\EventLog\Application\File#value
        
        Potential EventLog File Location Tampering Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Services\EventLog\HardwareEvents#
        
        HKLM\SYSTEM\ControlSet001\Services\EventLog\HardwareEvents\File#value
        
        Potential EventLog File Location Tampering Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Services\EventLog\Internet Explorer#
        
        HKLM\SYSTEM\ControlSet001\Services\EventLog\Internet Explorer\CustomSD#value
        
        Windows New Custom Security Descriptor Set On EventLog Channel Splunk (inferred path)
        Windows Event Log Access Tampering Via Registry Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Services\EventLog\Security#
        
        HKLM\SYSTEM\ControlSet001\Services\EventLog\Security\File#value
        
        Potential EventLog File Location Tampering Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Services\EventLog\Security\LSA#
        
        Windows Credential Guard Related Registry Value Deleted - Registry Sigma (inferred branch)
        HKLM\SYSTEM\ControlSet001\Services\EventLog\Security\Security\ObjectNames#
        
        HKLM\SYSTEM\ControlSet001\Services\EventLog\Security\Security\ObjectNames\File#value
        
        Potential EventLog File Location Tampering Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Services\EventLog\System#
        
        HKLM\SYSTEM\ControlSet001\Services\EventLog\System\File#value
        
        Potential EventLog File Location Tampering Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\HybridConnectionManager#
        
        HybridConnectionManager Service Installation - Registry Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\Instances\Sysmon Instance\Altitude#
        
        Sysmon Driver Altitude Change Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\LanmanServer#
        
        HKLM\SYSTEM\ControlSet001\Services\LanmanServer\Parameters#
        
        Disable Administrative Share Creation at Startup Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        HKLM\SYSTEM\ControlSet001\Services\LanmanServer\Parameters#
        
        MaxMpxCt Registry Value Changed Sigma (inferred branch)
        
        HKLM\SYSTEM\ControlSet001\Services\LanmanServer\Parameters\NullSessionPipes#value
        
        NullSessionPipe Registry Modification Elastic (inferred path)
        Suspicious NullSessionPipe Registry Modification Elastic (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\LanmanWorkstation#
        
        HKLM\SYSTEM\ControlSet001\Services\LanmanWorkstation\NetworkProvider#
        
        Suspicious Windows Authentication Registry Modification Elastic (inferred path)
        
        HKLM\SYSTEM\ControlSet001\Services\LanmanWorkstation\NetworkProvider\ProviderPath#value
        
        Network Logon Provider Registry Modification Elastic (inferred path)
        HKLM\SYSTEM\ControlSet001\Services\LanmanWorkstation\NetworkProvider#
        
        CVE-2023-23397 Exploitation Attempt Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\services\localNETService#
        
        Registry Entries For Azorult Malware Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\NTDS#
        
        Suspicious Windows Authentication Registry Modification Elastic (inferred path)
        
        HKLM\SYSTEM\ControlSet001\Services\NTDS\DirectoryServiceExtPt#value
        
        DLL Load via LSASS Sigma (inferred path)
        Windows Autostart Execution LSASS Driver Registry Modification Splunk (inferred path)
        HKLM\SYSTEM\ControlSet001\Services\NTDS\LsaDbExtPt#value
        
        DLL Load via LSASS Sigma (inferred path)
        Windows Autostart Execution LSASS Driver Registry Modification Splunk (inferred path)
      - HKLM\SYSTEM\ControlSet001\services\null\Instance#
        
        Pandemic Registry Key Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\P9NP\NetworkProvider#
        
        Suspicious Windows Authentication Registry Modification Elastic (inferred path)
        
        HKLM\SYSTEM\ControlSet001\Services\P9NP\NetworkProvider\ProviderPath#value
        
        Network Logon Provider Registry Modification Elastic (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\PortProxy#
        
        Port Forwarding Rule Addition Elastic (inferred branch)
        Windows Proxy Via Registry Splunk (inferred branch)
        
        HKLM\SYSTEM\ControlSet001\Services\PortProxy\v4tov4\tcp#
        
        New PortProxy Registry Entry Added Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\RDPNP\NetworkProvider#
        
        Suspicious Windows Authentication Registry Modification Elastic (inferred path)
        
        HKLM\SYSTEM\ControlSet001\Services\RDPNP\NetworkProvider\ProviderPath#value
        
        Network Logon Provider Registry Modification Elastic (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\RemoteAccess\RouterManagers#
        
        Windows Routing and Remote Access Service Registry Key Change Splunk (inferred branch)
      - HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService#
        
        HKLM\SYSTEM\ControlSet001\Services\SecurityHealthService\Start#value
        
        Microsoft Defender service components status disabled (Registry via Sysmon) Sigma (inferred path)
        Disabling Defender Services Splunk (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\Sense#
        
        HKLM\SYSTEM\ControlSet001\Services\Sense\Start#value
        
        Microsoft Defender service components status disabled (Registry via Sysmon) Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\SharedAccess#
        
        HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules#
        
        Detect Windows Allow Firewall Rule Addition/Modification Kusto (inferred path)
        HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy#
        
        HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile#
        
        HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall#value
        
        Disable Microsoft Defender Firewall via Registry Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules#
        
        Potential Endpoint Security Evasion via FirewallRules Elastic (inferred path)
        Windows Modify Registry Delete Firewall Rules Splunk (inferred branch)
        Firewall Policy Changed by a Suspicious Process Elastic (inferred path)
        Windows Filtering Platform Policy Added to Block EDR Process Splunk (inferred path)
        Allow Inbound Traffic By Firewall Rule Registry Splunk (inferred path)
        Windows Modify Registry to Add or Modify Firewall Rule Splunk (inferred path)
        HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile#
        
        HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall#value
        
        Disable Microsoft Defender Firewall via Registry Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices#
        
        HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System#
        
        Detect Windows Allow Firewall Rule Addition/Modification Kusto (inferred path)
        HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System#
        
        Detect Windows Allow Firewall Rule Addition/Modification Kusto (inferred path)
        HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile#
        
        HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall#value
        
        Disable Microsoft Defender Firewall via Registry Sigma (inferred path)
        Stored data is DWORD (0x00000000)
      - HKLM\SYSTEM\ControlSet001\Services\Sophos Endpoint Defense\TamperProtection\Config#
        
        Tamper With Sophos AV Registry Keys Sigma (inferred path) Path reference
        Values: SAVEnabled or SEDEnabled
        Stored data is DWORD (0x00000000)
      - HKLM\SYSTEM\ControlSet001\Services\TermService\Parameters#
        
        RDP Sensitive Settings Changed Chronicle (inferred branch)
        RDP Sensitive Settings Changed Sigma (inferred path)
        Values: ServiceDll or ServiceDllUnloadOnStop
      - HKLM\SYSTEM\ControlSet001\Services\TPM\WMI\Endorsement#
        
        Windows Registry Certificate Added Splunk (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\vmhgfs\networkprovider#
        
        Suspicious Windows Authentication Registry Modification Elastic (inferred path)
        
        HKLM\SYSTEM\ControlSet001\Services\vmhgfs\networkprovider\ProviderPath#value
        
        Network Logon Provider Registry Modification Elastic (inferred path)
      - HKLM\System\ControlSet001\Services\VSS#
        
        Esentutl Volume Shadow Copy Service Keys Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\VSS#
        
        HKLM\SYSTEM\ControlSet001\Services\VSS\Providers\{b5946137-7b9f-4925-af80-51abd60b20d5}\CLSID#
        
        Malicious InProcServer32 Modification Splunk (inferred branch)
        HKLM\SYSTEM\ControlSet001\Services\VSS\Start#value
        
        Shadow Copy Service Disabled via Registry Modification Elastic (inferred path)
        Stored data is 4
        VSS Service Disabled Followed by a Suspicious File Rename Elastic (inferred path)
        Stored data is 4
      - HKLM\SYSTEM\ControlSet001\Services\W32Time\TimeProviders#
        
        Potential Persistence via Time Provider Modification Elastic (inferred path)
        
        HKLM\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\NtpClient#
        
        HKLM\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\NtpClient\DllName#value
        
        Time Provider Persistence Registry Splunk (inferred path)
        New TimeProviders Registered With Uncommon DLL Name Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\NtpServer#
        
        HKLM\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\NtpServer\DllName#value
        
        Time Provider Persistence Registry Splunk (inferred path)
        New TimeProviders Registered With Uncommon DLL Name Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\VMICTimeProvider#
        
        HKLM\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\VMICTimeProvider\DllName#value
        
        Time Provider Persistence Registry Splunk (inferred path)
        New TimeProviders Registered With Uncommon DLL Name Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\WCESERVICE\Start#
        
        Windows Credential Editor Registry Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\WdBoot#
        
        HKLM\SYSTEM\ControlSet001\Services\WdBoot\Start#value
        
        Microsoft Defender service components status disabled (Registry via Sysmon) Sigma (inferred path)
        Disabling Defender Services Splunk (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\WdFilter#
        
        HKLM\SYSTEM\ControlSet001\Services\WdFilter\Start#value
        
        Microsoft Defender service components status disabled (Registry via Sysmon) Sigma (inferred path)
        Disabling Defender Services Splunk (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\WdNisDrv#
        
        HKLM\SYSTEM\ControlSet001\Services\WdNisDrv\Start#value
        
        Microsoft Defender service components status disabled (Registry via Sysmon) Sigma (inferred path)
        Disabling Defender Services Splunk (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\WdNisSvc#
        
        HKLM\SYSTEM\ControlSet001\Services\WdNisSvc\Start#value
        
        Microsoft Defender service components status disabled (Registry via Sysmon) Sigma (inferred path)
        Disabling Defender Services Splunk (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\WebClient#
        
        HKLM\SYSTEM\ControlSet001\Services\WebClient\NetworkProvider#
        
        Suspicious Windows Authentication Registry Modification Elastic (inferred path)
        
        HKLM\SYSTEM\ControlSet001\Services\WebClient\NetworkProvider\ProviderPath#value
        
        Network Logon Provider Registry Modification Elastic (inferred path)
        HKLM\SYSTEM\ControlSet001\Services\WebClient\NetworkProvider#
        
        CVE-2023-23397 Exploitation Attempt Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\wercplsupport\Parameters#
        
        HKLM\SYSTEM\ControlSet001\Services\wercplsupport\Parameters\ServiceDll#value
        
        Blue Mockingbird - Registry Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\WinDefend#
        
        HKLM\SYSTEM\ControlSet001\Services\WinDefend\Start#value
        
        Windows Defender Service Disabled - Registry Sigma (inferred path)
        Stored data is DWORD (0x00000004)
        Microsoft Defender service components status disabled (Registry via Sysmon) Sigma (inferred path)
        Disabling Defender Services Splunk (inferred path)
        Windows Defender Disabled via Registry Modification Elastic (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\WinSock2#
        
        Impacket DCOMexec privilege abuse via MMC Sigma
        
        HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters#
        
        HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\AutodialDLL#value
        
        Persistence via AutodialDLL Registry Modification Elastic (inferred path)
        Potential Persistence Via AutodialDLL Sigma (inferred path)
        HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5#
        
        WinSock2 Autorun Keys Modification Sigma (inferred path)
        Persistence via WinSock Name Space DLL Elastic (inferred path)
        HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9#
        
        WinSock2 Autorun Keys Modification Sigma (inferred path)
      - HKLM\SYSTEM\ControlSet001\Services\wscsvc#
        
        HKLM\SYSTEM\ControlSet001\Services\wscsvc\Start#value
        
        Microsoft Defender service components status disabled (Registry via Sysmon) Sigma (inferred path)
  - HKLM\SYSTEM\CrowdStrike#
    
    Windows CrowdStrike Agent Registry Key Removal Splunk (inferred path)
  - HKLM\SYSTEM\CurentControlSet\Control\Session Manager\AppCertDlls#
    
    New DLL Added to AppCertDlls Registry Key Sigma
  - HKLM\SYSTEM\CurrentControlSet#
    - HKLM\SYSTEM\CurrentControlSet\Control#
      - HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\LongPathsEnabled#
        
        Blackbyte Ransomware Registry Chronicle
      - HKLM\SYSTEM\CurrentControlSet\Control\MiniNt#
        
        Disable Security Events Logging Adding Reg Key MiniNt Sigma
        
        HKLM\SYSTEM\CurrentControlSet\Control\MiniNt\(Default)#
        
        Security Event Logging Disabled via MiniNt Registry Key - Registry Set Sigma
      - HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls#
        
        New DLL Added to AppCertDlls Registry Key Sigma
    - HKLM\System\CurrentControlSet\Enum\SWD\WPDBUSENUM#
      
      Windows Process Executed From Removable Media Splunk (path prefix)
      Stored data is *:\*
      Windows WPDBusEnum Registry Key Modification Splunk (path prefix)
    - HKLM\System\CurrentControlSet\Services#
      
      Mimikatz driver registration (Reg via Sysmon) Sigma
      - HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters#
        
        DNS Global Query Block List Modified or Disabled Elastic (documented path) Path reference
        Values: EnableGlobalQueryBlockList or GlobalQueryBlockList
        
        HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\ServerLevelPluginDll#value
        
        DLL ServerLevelPluginDll registration (Reg via Sysmon) Sigma (documented path) Path reference
        New DNS ServerLevelPluginDll Installed Sigma (documented path) Path reference
      - HKLM\System\CurrentControlSet\Services\Fax\ObjectName#
        
        Change User Account Associated with the FAX Service Sigma
      - HKLM\System\CurrentControlSet\Services\NalDrv\ImagePath#
        
        Suspicious Service Installed Sigma
      - HKLM\System\CurrentControlSet\Services\PortProxy\v4tov4#
        
        MITRE ATT&CK T1090 Port Proxy Forwarding CISA Report Chronicle
      - HKLM\System\CurrentControlSet\Services\PROCEXP152\ImagePath#
        
        Suspicious Service Installed Sigma
  - HKLM\SYSTEM\Keyboard Layout\Preload#
    - HKLM\SYSTEM\Keyboard Layout\Preload\1#value
      
      Suspicious Keyboard Layout Load Sigma (inferred path)
  - HKLM\SYSTEM\MountedDevices#
    
    Spearphishing Attachment: ISO Images (Microsoft Sentinel) Kusto (inferred branch)
    Spearphishing Attachment: ISO Images (Microsoft Defender for Endpoint) Kusto (inferred path)
    Values: \DosDevices\C: or \DosDevices\D:
  - HKLM\SYSTEM\Remote Manipulator System#
    
    Windows Remote Access Software RMS Registry Splunk (documented branch) Path reference
  - HKLM\SYSTEM\Setup#
    
    Common Autorun Keys Modification Sigma (inferred path)
    Uncommon Registry Persistence Change Elastic (inferred path)
    Suspicious Registry Modification via WMI Elastic (inferred path)
    - HKLM\SYSTEM\Setup\PrintResponsor#
      
      FlowCloud Registry Markers Sigma (inferred path)
    - HKLM\SYSTEM\Setup\Service Reporting API#
      
      Windows Installer with Suspicious Properties Elastic (inferred path)
  - HKLM\SYSTEM\SOFTWARE\Microsoft#
    
    ETW Logging Disabled In .NET Processes - Sysmon Registry Sigma (inferred branch)
    Windows Modify Registry Qakbot Binary Data Registry Splunk (inferred path)
    Windows Modify Registry With MD5 Reg Key Name Splunk (inferred path)
    Stored data is Binary Data
    Set Default PowerShell Execution Policy To Unrestricted or Bypass Splunk (inferred branch)
    NET NGenAssemblyUsageLog Registry Key Tamper Sigma (inferred branch)
HKCU #
- HKCU\Control Panel\Desktop#
  - HKCU\Control Panel\Desktop\SCRNSAVE.EXE#
    
    Path To Screensaver Binary Modified Sigma (inferred path)
  - HKCU\Control Panel\Desktop\scrnsave.exe#
    
    Uncommon Registry Persistence Change Elastic (inferred path)
- HKCU\Environment#
  
  Potential Persistence Via Logon Scripts - Registry Sigma (inferred path) Path reference
  Privilege Escalation via Windir or SystemRoot Environment Variable Elastic (inferred path) Path reference
  Enabling COR Profiler Environment Variables Sigma (inferred path) Path reference
  Python PYTHONPATH Modification During Package Installation Splunk (inferred path) Path reference
  - HKCU\Environment\COR_PROFILER_PATH#
    
    UAC Bypass Attempt via MMC DLL Search Order Hijacking Elastic (inferred path)
  - HKCU\Environment\UserInitMprLogonScript#
    
    Uncommon Persistence via Registry Modification Elastic (inferred path)
    Registry or File Modification from Suspicious Memory Elastic (inferred path)
    Uncommon Registry Persistence Change Elastic (inferred path)
    Suspicious Registry Modification via WMI Elastic (inferred path)
- HKCU\Software#
  - HKCU\SOFTWARE\App#
    
    OceanLotus Registry Activity Sigma (inferred path)
  - HKCU\Software\AppDataLow\Software\Microsoft\3A861D62-51E0-7C9D-AB0E-15700F2219A4#
    
    Potential Ursnif Malware Activity - Registry Sigma (inferred path)
  - HKCU\Software\Classes\CLSID#
    
    Component Object Model Hijacking Elastic (inferred path)
    Potential COM Object Hijacking Via TreatAs Subkey - Registry Sigma (inferred path)
  - HKCU\Software\firm\soft\Name#
    
    Potential Qakbot Registry Activity Sigma (inferred path)
  - HKCU\software\Martin Prikryl#
    
    Sensitive File Access - System Admin Utilities Elastic (inferred path)
  - HKCU\SOFTWARE\Microsoft#
    - HKCU\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel#
      
      ClickOnce Trust Prompt Tampering Sigma (inferred path)
      Stored data is Enabled
    - HKCU\SOFTWARE\Microsoft\Active Setup\Installed Components#
      
      Run Once Task Configuration in Registry Sigma (inferred path)
    - HKCU\SOFTWARE\Microsoft\Command Processor\Autorun#
      
      Uncommon Persistence via Registry Modification Elastic (inferred path)
    - HKCU\SOFTWARE\Microsoft\Cryptography\Providers#
      
      Kapeka Backdoor Configuration Persistence Sigma (inferred path)
    - HKCU\SOFTWARE\Microsoft\Ctf\LangBarAddin#
      
      Uncommon Persistence via Registry Modification Elastic (inferred path)
    - HKCU\Software\Microsoft\Fax\Device Providers#
      
      Change the Fax Dll Sigma (inferred path)
    - HKCU\Software\Microsoft\HtmlHelp Author\Location#
      
      Potential Persistence Via CHM Helper DLL Sigma (inferred path)
    - HKCU\SOFTWARE\Microsoft\Internet Explorer#
      - HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions#
        
        Uncommon Persistence via Registry Modification Elastic (inferred path)
      - HKCU\Software\microsoft\Internet Explorer\Intelliforms#
        
        Windows Unusual Intelliform Storage Registry Access Splunk (inferred path)
    - HKCU\SOFTWARE\Microsoft\NetSh#
      
      Netsh helper DLL abuse (Reg via Sysmon) Sigma (inferred path)
    - HKCU\Software\Microsoft\Office#
      
      Potential Persistence Via Outlook Today Page Sigma (inferred path)
      Outlook Security Settings Updated - Registry Sigma (inferred path)
      Microsoft Office Protected View Disabled Sigma (inferred path)
      Outlook Task/Note Reminder Received Sigma (inferred path)
      Macro Enabled In A Potentially Suspicious Document Sigma (inferred path) Path reference
      Uncommon Microsoft Office Trusted Location Added Sigma (inferred path) Path reference
      Potential Persistence Via Outlook Home Page Sigma (inferred path)
      Python Function Execution Security Warning Disabled In Excel - Registry Sigma (inferred path)
      Stored data is DWORD (0x00000001)
      Suspicious MS Office Execution via DCOM Elastic (inferred path)
      Microsoft Office Trusted Location Updated Sigma (inferred path) Path reference
      Windows Registry Trust Record Modification Sigma (inferred path) Path reference
      Disable Macro Runtime Scan Scope Sigma (inferred path)
      Stored data is DWORD (0x00000000)
    - HKCU\Software\Microsoft\Office#
      
      Potential Persistence Via Excel Add-in - Registry Sigma (inferred path)
      Potential Persistence Via Outlook Today Page Sigma (inferred path)
    - HKCU\Software\Microsoft\Office Test\Special#
      - HKCU\Software\Microsoft\Office Test\Special\Perf#
        
        Office Test Registry Persistence Elastic (inferred path)
      - HKCU\Software\Microsoft\Office test\Special\Perf#
        
        Office Application Startup - Office Test Sigma (inferred path)
    - HKCU\SOFTWARE\Microsoft\Test#
      
      Windows SnappyBee Create Test Registry Splunk (inferred path)
    - HKCU\SOFTWARE\Microsoft\Windows Defender#
      - HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions#
        
        Windows Defender Exclusion Registry Key - Write Access Requested Sigma (inferred path)
      - HKCU\SOFTWARE\Microsoft\Windows Defender\Threats\ThreatSeverityDefaultAction#
        
        Windows Defender Threat Severity Default Action Modified Sigma (inferred path)
      - HKCU\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications#
        
        Suspicious Application Allowed Through Exploit Guard Sigma (inferred path)
    - HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion#
      - HKCU\Software\Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration#
        
        Atbroker Registry Change Sigma (inferred path) Path reference
      - HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags#
        
        HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom#
        
        Suspicious Shim Database Patching Activity Sigma (inferred path)
        HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom#
        
        Installation of Custom Shim Databases Elastic (inferred path)
        HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB#
        
        Potential Persistence Via Shim Database In Uncommon Location Sigma (inferred path)
      - HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options#
        
        Sticky Key Like Backdoor Usage - Registry Sigma (inferred path)
      - HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache#
        
        HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks#
        
        Scheduled Task Created - Registry Sigma (inferred path)
        HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree#
        
        Diamond Sleet APT Scheduled Task Creation - Registry Sigma (inferred path)
        Scheduled Task Created - Registry Sigma (inferred path)
      - HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\lsass.exe#
        
        Potential Credential Dumping Via LSASS SilentProcessExit Technique Sigma (inferred path)
      - HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore#
        
        Registry Disable System Restore Sigma (inferred path)
        Stored data is DWORD (0x00000001)
      - HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load#
        
        Uncommon Persistence via Registry Modification Elastic (inferred path)
    - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion#
      - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe#
        
        CMSTP App Paths Registry Key Modification Sigma (inferred path)
      - HKCU\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore#
        
        Suspicious Camera and Microphone Access Sigma (inferred path)
        
        HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged#
        
        Processes Accessing the Microphone and Webcam Sigma (inferred path)
        HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged#
        
        Processes Accessing the Microphone and Webcam Sigma (inferred path)
      - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer#
        
        Windows RunMRU Command Execution Splunk (inferred path)
        
        HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced#
        
        Attempt to Hide Files via Registry Modification Elastic (inferred path)
      - HKCU\software\microsoft\windows\currentversion\group policy\scripts#
        
        HKCU\software\microsoft\windows\currentversion\group policy\scripts\logoff#
        
        CurrentVersion Autorun Keys Modification Chronicle (inferred path)
        HKCU\software\microsoft\windows\currentversion\group policy\scripts\logon#
        HKCU\software\microsoft\windows\currentversion\group policy\scripts\shutdown#
        HKCU\software\microsoft\windows\currentversion\group policy\scripts\startup#
        
        CurrentVersion Autorun Keys Modification Chronicle (inferred path)
      - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings#
        
        Internet Activity from Suspicious Unbacked Memory Elastic (inferred path)
      - HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance\Enabled#
        
        Defense Evasion via Registry Modification Elastic (inferred path)
      - HKCU\Software\Microsoft\Windows\CurrentVersion\PackagedAppXDebug#
        
        Potential Persistence Using DebugPath Sigma (inferred path)
      - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies#
        
        Disable Internal Tools or Feature in Registry Chronicle (inferred path)
        
        HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations#
        
        Potential Attachment Manager Settings Associations Tamper Sigma (inferred path)
        HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer#
        
        HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run#
        
        Persistence via Hidden Run Key Detected Elastic (inferred path)
        New RUN Key Pointing to Suspicious Folder Chronicle (inferred path)
        Registry or File Modification from Suspicious Memory Elastic (inferred path)
        Suspicious String Value Written to Registry Run Key Elastic (inferred path)
        Suspicious Registry Modification via WMI Elastic (inferred path)
        CurrentVersion Autorun Keys Modification Chronicle (inferred path)
        HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run#
        
        Suspicious Run Key from Download Sigma (inferred path)
        HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System#
        
        Defense Evasion via Registry Modification Elastic (inferred path)
        
        HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Shell#
        
        Uncommon Persistence via Registry Modification Elastic (inferred path)
        CurrentVersion Autorun Keys Modification Chronicle (inferred path)
        HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Shell#
        
        Registry or File Modification from Suspicious Memory Elastic (inferred path)
        Suspicious Registry Modification via WMI Elastic (inferred path)
      - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications\ToastEnabled#
        
        Disable Internal Tools or Feature in Registry Chronicle (inferred path)
      - HKCU\Software\Microsoft\Windows\CurrentVersion\Run#
        
        Add DLL_EXE Registry Value (Sysmon) Splunk (inferred path) Path reference
        Persistence via Hidden Run Key Detected Elastic (inferred path)
        New RUN Key Pointing to Suspicious Folder Chronicle (inferred path)
        Suspicious String Value Written to Registry Run Key Elastic (inferred path)
        
        HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Backup Mgr#
        
        WINEKEY Registry Modification Sigma (inferred path)
        HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ntkd#
        
        Leviathan Registry Key Activity Sigma (inferred path)
        HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos#
        
        Remcos RAT Registry or File Modification Elastic (inferred path)
      - HKCU\Software\Microsoft\Windows\CurrentVersion\Run#
        
        Suspicious Run Key from Download Sigma (inferred path)
      - HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce#
        
        Add DLL_EXE Registry Value (Sysmon) Splunk (inferred path) Path reference
      - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\UMe#
        
        OilRig APT Registry Persistence Sigma (inferred path)
      - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\UT#
        
        OilRig APT Registry Persistence Sigma (inferred path)
  - HKCU\SOFTWARE\NetWire#
    
    Potential NetWire RAT Activity - Registry Sigma (inferred path)
    - HKCU\SOFTWARE\NetWire\HostId#
      
      NetWire RAT Registry Modification Elastic (inferred path)
    - HKCU\SOFTWARE\NetWire\Install Date#
      
      NetWire RAT Registry Modification Elastic (inferred path)
  - HKCU\Software\OpenVPN-GUI\Configs#
    
    Sensitive File Access - System Admin Utilities Elastic (inferred path)
    Failed Attempts to Access Sensitive Files Elastic (inferred path)
  - HKCU\SOFTWARE\Policies\Microsoft#
    - HKCU\Software\Policies\Microsoft\Office\16.0#
      - HKCU\Software\Policies\Microsoft\Office\16.0\Access\Security#
        
        HKCU\Software\Policies\Microsoft\Office\16.0\Access\Security\VbaWarnings#value
        
        MS Office Macro Security Registry Modifications Elastic (documented path) Path reference
        Office Macros Warning Disabled Sigma (documented path) Path reference
        Stored data is DWORD (0x00000001)
      - HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security#
        
        HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\AccessVBOM#value
        
        Trust Access Disable For VBApplications Sigma (documented path) Path reference
        Stored data is DWORD (0x00000001)
        MS Office Macro Security Registry Modifications Elastic (documented path) Path reference
        HKCU\Software\Policies\Microsoft\Office\16.0\Excel\Security\VbaWarnings#value
        
        MS Office Macro Security Registry Modifications Elastic (documented path) Path reference
        Office Macros Warning Disabled Sigma (documented path) Path reference
        Stored data is DWORD (0x00000001)
      - HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security#
        
        HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\AccessVBOM#value
        
        MS Office Macro Security Registry Modifications Elastic (documented path) Path reference
        Trust Access Disable For VBApplications Sigma (documented path) Path reference
        Stored data is DWORD (0x00000001)
        HKCU\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security\VbaWarnings#value
        
        MS Office Macro Security Registry Modifications Elastic (documented path) Path reference
        Office Macros Warning Disabled Sigma (documented path) Path reference
        Stored data is DWORD (0x00000001)
      - HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security#
        
        HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\AccessVBOM#value
        
        MS Office Macro Security Registry Modifications Elastic (documented path) Path reference
        Trust Access Disable For VBApplications Sigma (documented path) Path reference
        Stored data is DWORD (0x00000001)
        HKCU\Software\Policies\Microsoft\Office\16.0\Word\Security\VbaWarnings#value
        
        MS Office Macro Security Registry Modifications Elastic (documented path) Path reference
        Office Macros Warning Disabled Sigma (documented path) Path reference
        Stored data is DWORD (0x00000001)
    - HKCU\SOFTWARE\Policies\Microsoft\Windows#
      
      Disable Internal Tools or Feature in Registry Chronicle (inferred path)
      - HKCU\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging#
        
        HKCU\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging\EnableScriptBlockLogging#value
        
        PowerShell Logging Disabled Via Registry Key Tampering Sigma (documented path) Path reference
        Stored data is DWORD (0x00000000)
        PowerShell Script Block Logging Disabled Elastic (documented path) Path reference
        Stored data is 0 or 0x00000000
      - HKCU\SOFTWARE\Policies\Microsoft\Windows\System#
        
        HKCU\SOFTWARE\Policies\Microsoft\Windows\System\Scripts#
        
        Uncommon Persistence via Registry Modification Elastic (inferred path)
        Registry or File Modification from Suspicious Memory Elastic (inferred path)
        Uncommon Registry Persistence Change Elastic (inferred path)
        Suspicious Registry Modification via WMI Elastic (inferred path)
        HKCU\Software\Policies\Microsoft\Windows\System\Scripts#
        
        System Scripts Autorun Keys Modification Sigma (inferred path)
    - HKCU\SOFTWARE\Policies\Microsoft\Windows NT#
      - HKCU\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore#
        
        Registry Disable System Restore Sigma (inferred path)
        Stored data is DWORD (0x00000001)
      - HKCU\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services#
        
        RDP shadow session configuration enabled (registry) Sigma (inferred path)
  - HKCU\Software\Remcos#
    
    Remcos client registry install entry Splunk (inferred path)
  - HKCU\Software\SimonTatham\PuTTY\SshHostKeys#
    
    Sensitive File Access - SSH Saved Keys Elastic (inferred path)
  - HKCU\Software\Sysinternals#
    
    Suspicious Execution Of Renamed Sysinternals Tools - Registry Sigma (inferred path) Path reference
    PUA - Sysinternals Tools Execution - Registry Sigma (inferred path) Path reference
    Usage of Renamed Sysinternals Tools - RegistrySet Sigma (inferred path) Path reference
  - HKCU\Software\Winternals\BGInfo#
    - HKCU\Software\Winternals\BGInfo\Database#
      
      New BgInfo.EXE Custom DB Path Registry Configuration Sigma (inferred path) Path reference
    - HKCU\Software\Winternals\BGInfo\UserFields#
      
      New BgInfo.EXE Custom VBScript Registry Configuration Sigma (documented branch) Path reference
      New BgInfo.EXE Custom WMI Query Registry Configuration Sigma (documented branch) Path reference
  - HKCU\SOFTWARE\WOW6432Node#
    - HKCU\Software\Wow6432Node\Classes#
      - HKCU\Software\Wow6432Node\Classes\AllFileSystemObjects\ShellEx\DragDropHandlers#
        
        Wow6432Node Classes Autorun Keys Modification Sigma (inferred path)
      - HKCU\Software\Wow6432Node\Classes\CLSID#
        
        Wow6432Node Classes Autorun Keys Modification Sigma (inferred path)
      - HKCU\Software\Wow6432Node\Classes\Directory\Shellex#
        
        Wow6432Node Classes Autorun Keys Modification Sigma (inferred path)
      - HKCU\Software\Wow6432Node\Classes\Folder\ShellEx#
        
        Wow6432Node Classes Autorun Keys Modification Sigma (inferred path)
      - HKCU\Software\Wow6432Node\Classes\ShellEx#
        
        Wow6432Node Classes Autorun Keys Modification Sigma (inferred path)
    - HKCU\Software\Wow6432Node\Classes#
      
      Wow6432Node Classes Autorun Keys Modification Sigma (inferred path)
    - HKCU\SOFTWARE\WOW6432Node\Facebook_Assistant#
      
      Revil Registry Entry Splunk (inferred path)
    - HKCU\Software\Wow6432Node\Google\Chrome\Extensions#
      
      Running Chrome VPN Extensions via the Registry 2 VPN Extension Sigma (inferred path)
    - HKCU\Software\WOW6432Node\Microsoft#
      - HKCU\Software\WOW6432Node\Microsoft\HtmlHelp Author\Location#
        
        Potential Persistence Via CHM Helper DLL Sigma (inferred path)
      - HKCU\Software\WOW6432Node\Microsoft\Windows\CurrentVersion#
        
        HKCU\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run#
        
        Registry or File Modification from Suspicious Memory Elastic (inferred path)
        Suspicious String Value Written to Registry Run Key Elastic (inferred path)
        HKCU\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run#
        
        Persistence via Hidden Run Key Detected Elastic (inferred path)
        New RUN Key Pointing to Suspicious Folder Chronicle (inferred path)
        Suspicious String Value Written to Registry Run Key Elastic (inferred path)
        HKCU\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run#
        
        Suspicious Run Key from Download Sigma (inferred path)
    - HKCU\SOFTWARE\WOW6432Node\TeamViewer\ProxyPassword#
      
      Sensitive File Access - System Admin Utilities Elastic (inferred path)
      Failed Attempts to Access Sensitive Files Elastic (inferred path)
HKU #

Microsoft Office Fetching Remote Content Elastic (path prefix)
UAC Bypass via Control Panel Execution Hijack Elastic
UAC Bypass via ComputerDefaults Execution Hijack Elastic
Outlook Home Page Registry Modification Elastic Endpoint behavior rule (path prefix)
UAC Bypass via FodHelper Execution Hijack Elastic
Code Signing Policy Modification Through Registry Elastic (documented branch)
UAC Bypass via Windows Activation Execution Hijack Elastic
- HKU\.Default#
  - HKU\.DEFAULT\Console#
    
    Windows Modify Registry ValleyRAT C2 Config Splunk (inferred branch)
  - HKU\.DEFAULT\Control Panel\Desktop#
    
    Screensaver Event Trigger Execution Splunk (inferred branch)
    ScreenSaver Registry Key Set Sigma (inferred branch)
  - HKU\.DEFAULT\Environment#
    
    Privilege Escalation via Windir Environment Variable Elastic (inferred branch)
    Windows Anomalous Registry Value Length in Environment Key Splunk (inferred path)
    Suspicious Environment Variable Has Been Registered Sigma (inferred path)
    Logon Script Event Trigger Execution Splunk (inferred branch)
    NET Profiler UAC bypass Splunk (inferred branch)
    Stored data is *.dll
  - HKU\.DEFAULT\Keyboard Layout#
    - HKU\.DEFAULT\Keyboard Layout\Preload#
      - HKU\.DEFAULT\Keyboard Layout\Preload\1#value
        
        Suspicious Keyboard Layout Load Sigma (inferred path)
    - HKU\.Default\Keyboard Layout\Substitutes#
      - HKU\.Default\Keyboard Layout\Substitutes\00000409#value
        
        Suspicious Keyboard Layout Load Sigma (inferred path)
  - HKU\.Default\SOFTWARE#
    
    Windows Modify Registry Qakbot Binary Data Registry Splunk (inferred path)
    Windows Installer with Suspicious Properties Elastic (inferred path)
    Windows Modify Registry With MD5 Reg Key Name Splunk (inferred path)
    Stored data is Binary Data
    - HKU\.DEFAULT\Software\Classes\Local Settings#
      
      Component Object Model Registry Modification by a Low Reputation Process Elastic (inferred branch)
      Suspicious Component Object Model Registry Modification Elastic (inferred branch)
      Suspicious Windows Script Downloaded from the Internet Elastic (inferred path)
      - HKU\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion#
        
        VBScript Payload Stored in Registry Sigma (inferred path)
    - HKU\.Default\SOFTWARE\Microsoft#
      - HKU\.DEFAULT\Software\Microsoft\Edge#
        
        Windows Impair Defense Override SmartScreen Prompt Splunk (inferred branch)
        Stored data is 0x00000000
      - HKU\.Default\SOFTWARE\Microsoft\IdentityCRL\Environment#
        
        Privilege Escalation via Windir Environment Variable Elastic (inferred branch)
        Windows Anomalous Registry Value Length in Environment Key Splunk (inferred path)
        Suspicious Environment Variable Has Been Registered Sigma (inferred path)
        Logon Script Event Trigger Execution Splunk (inferred branch)
        NET Profiler UAC bypass Splunk (inferred branch)
        Stored data is *.dll
        
        HKU\.Default\SOFTWARE\Microsoft\IdentityCRL\Environment\COMPlus_ETWEnabled#value
        
        Windows Registry Dotnet ETW Disabled Via ENV Variable Splunk (inferred path)
        ETW Logging Disabled In .NET Processes - Registry Sigma (inferred path)
        HKU\.Default\SOFTWARE\Microsoft\IdentityCRL\Environment\COMPlus_ETWFlags#value
        
        ETW Logging Disabled In .NET Processes - Registry Sigma (inferred path)
      - HKU\.DEFAULT\Software\Microsoft\Windows#
        
        HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion#
        
        VBScript Payload Stored in Registry Sigma (inferred path)
        Suspicious Windows Script Downloaded from the Internet Elastic (inferred path)
        
        HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer#
        
        FileFix - Command Evidence in TypedPaths Sigma (inferred branch)
        Suspicious Space Characters in TypedPaths Registry Path - FileFix Sigma (inferred branch)
        Suspicious Space Characters in RunMRU Registry Path - ClickFix Sigma (inferred branch)
        Potential ClickFix Execution Pattern - Registry Sigma (inferred branch)
        Windows RunMRU Registry Key or Value Deleted Splunk (inferred branch)
        RunMRU Registry Key Deletion - Registry Sigma (inferred branch)
        Potential SharpRDP Behavior Elastic (inferred branch)
        Potential Persistence Via TypedPaths Sigma (inferred branch)
        Potentially Suspicious Command Executed Via Run Dialog Box - Registry Sigma (inferred branch)
        Command Executed Via Run Dialog Box - Registry Sigma (inferred branch)
        
        HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders#
        
        Modify User Shell Folders Startup Value Chronicle (inferred path)
        Registry Run Keys - Suspicious Registry Run Keys Kusto (inferred path)
        Registry Keys Used For Persistence Splunk (inferred path)
        Registry Persistence via Microsoft Office Descendant Process Elastic (inferred path)
        Suspicious Startup Shell Folder Modification Elastic (inferred path)
        Registry Modification via Microsoft Office Elastic (inferred path)
        
        HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup#value
        
        Modify User Shell Folders Startup Value Sigma (inferred path)
        Unusual Startup Shell Folder Modification Elastic (inferred path)
        HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings#
        
        Network Activity from a Stomped Module Elastic (inferred path)
        Modification of IE Registry Settings Sigma (inferred path)
        
        HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache#
        
        Registry Modification from a Potentially Altered Call Stack Elastic (inferred path)
        Potential Hardware Breakpoints Evasion Elastic (inferred path)
        
        HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content#
        
        HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix#value
        
        Potential Module Stomping with Network Activity Elastic (inferred path)
        HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies#
        
        HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix#value
        
        Potential Module Stomping with Network Activity Elastic (inferred path)
        HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History#
        
        HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix#value
        
        Potential Module Stomping with Network Activity Elastic (inferred path)
        HKU\.Default\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Internet Settings\AutoConfigURL#value
        
        Potential AutoConfigURL Settings Hijack Elastic (inferred path)
        HKU\.Default\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Internet Settings\ProxyEnable#value
        
        Windows Modify Registry ProxyEnable Splunk (inferred path)
        Stored data is 0x00000001
        HKU\.Default\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Internet Settings\ProxyServer#value
        
        Windows Modify Registry ProxyServer Splunk (inferred path)
        HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap#
        
        Potential Raspberry Robin Registry Set Internet Settings ZoneMap Sigma (inferred path)
        Values: AutoDetect or IntranetName or ProxyByPass or UNCAsIntranet
        
        HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains#
        
        HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\(Default)#value
        
        IE Change Domain Zone Sigma (inferred path)
        HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults#
        
        IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Sigma (inferred path)
        Values: http or https
        HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications#
        
        Windows Modify Registry Disable Toast Notifications Splunk (inferred branch)
        Stored data is 0x00000000
        HKU\.Default\SOFTWARE\Microsoft\WINDOWS\Windows Error Reporting#
        
        Lsass Full Dump Request Via DumpType Registry Settings Sigma (inferred branch)
        Stored data is DWORD (0x00000002)
        Add Debugger Entry To Hangs Key For Persistence Sigma (inferred branch)
        
        HKU\.Default\SOFTWARE\Microsoft\WINDOWS\Windows Error Reporting\DISABLED#value
        
        Windows Modify Registry Disabling WER Settings Splunk (inferred path)
        Stored data is 0x00000001
        HKU\.Default\SOFTWARE\Microsoft\WINDOWS\Windows Error Reporting\DontShowUI#value
        
        Windows Modify Registry DontShowUI Splunk (inferred path)
        Stored data is 0x00000001
      - HKU\.DEFAULT\Software\Microsoft\Windows Defender#
        
        Windows Impair Defense Configure App Install Control Splunk (inferred branch)
      - HKU\.Default\SOFTWARE\Microsoft\Windows NT\CurrentVersion#
        
        Suspicious Windows Script Downloaded from the Internet Elastic (inferred path)
        
        HKU\.Default\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices#
        
        Suspicious Registry Symbolic Link Elastic (inferred path)
        HKU\.Default\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts#
        
        Suspicious Registry Symbolic Link Elastic (inferred path)
      - HKU\.DEFAULT\Software\Microsoft\Windows Script\Settings#
        
        Disable AMSI Through Registry Splunk (inferred branch)
        AMSI Disabled via Registry Modification Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
    - HKU\.DEFAULT\Software\Policies#
      
      DNS-over-HTTPS Enabled by Registry Sigma (inferred branch)
      DNS-over-HTTPS Enabled via Registry Elastic (inferred branch)
      - HKU\.DEFAULT\Software\Policies\Microsoft#
        
        Suspicious Browser Files Modification Elastic (inferred branch)
        Disable Exploit Guard Network Protection on Windows Defender Sigma (inferred branch)
        Stored data is DWORD (00000001)
        Windows Modify Registry Disable WinDefender Notifications Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Impair Defense Disable Win Defender App Guard Splunk (inferred branch)
        Stored data is 0x00000000
        Windows Modify Registry Configure BitLocker Splunk (inferred branch)
        Disable Windows Firewall by Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
- HKU\<CURRENT_USER_SID>#
  - HKU\<CURRENT_USER_SID>\Control Panel\Desktop#
    
    Screensaver Event Trigger Execution Splunk (inferred branch)
    ScreenSaver Registry Key Set Sigma (inferred branch)
  - HKU\<CURRENT_USER_SID>\Environment#
    
    Privilege Escalation via Windir Environment Variable Elastic (inferred branch)
    Logon Script Event Trigger Execution Splunk (inferred branch)
    NET Profiler UAC bypass Splunk (inferred branch)
    Stored data is *.dll
    - HKU\<CURRENT_USER_SID>\Environment\COMPlus_ETWEnabled#value
      
      ETW Logging Disabled In .NET Processes - Registry Sigma (inferred path)
      Windows Registry Dotnet ETW Disabled Via ENV Variable Splunk (inferred path)
    - HKU\<CURRENT_USER_SID>\Environment\COMPlus_ETWFlags#value
      
      ETW Logging Disabled In .NET Processes - Registry Sigma (inferred path)
  - HKU\<CURRENT_USER_SID>\Keyboard Layout\Substitutes#
    - HKU\<CURRENT_USER_SID>\Keyboard Layout\Substitutes\00000409#value
      
      Suspicious Keyboard Layout Load Sigma (inferred path)
  - HKU\<CURRENT_USER_SID>\PRINTERS#
    
    Suspicious Registry Symbolic Link Elastic (inferred path)
  - HKU\<CURRENT_USER_SID>\SOFTWARE#
    - HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft#
      - HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Edge#
        
        Windows Impair Defense Override SmartScreen Prompt Splunk (inferred branch)
        Stored data is 0x00000000
        
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Edge\PreferenceMACs\DEFAULT\extensions.settings#
        
        Suspicious Registry Symbolic Link Elastic (inferred path)
      - HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Internet Explorer#
        
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio#
        
        Suspicious Registry Symbolic Link Elastic (inferred path)
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Internet Explorer\Main#
        
        Internet Explorer DisableFirstRunCustomize Enabled Sigma (inferred branch)
      - HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Office#
        
        Potential Persistence Via Visual Studio Tools for Office Sigma (inferred branch)
        
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Office\16.0#
        
        Outlook Home Page Registry Modification Elastic Detection rule (inferred branch)
        Windows Outlook WebView Registry Modification Splunk (inferred branch)
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Office\Outlook#
        
        Windows Outlook Dialogs Disabled from Unusual Process Splunk (inferred branch)
        Outlook Macro Execution Without Warning Setting Enabled Sigma (inferred branch)
        Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting Sigma (inferred branch)
        Outlook EnableUnsafeClientMailRules Setting Enabled - Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000001)
        Windows Outlook Macro Security Modified Splunk (inferred branch)
        Stored data is 0x00000001
        Outlook Home Page Registry Modification Elastic Detection rule (inferred branch)
        Windows Outlook WebView Registry Modification Splunk (inferred branch)
        
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Office\Outlook\Addins\TeamsAddin.FastConnect#
        
        Potential Persistence Via Visual Studio Tools for Office Sigma (inferred path)
        Office Autorun Keys Modification Sigma (inferred path)
        
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Office\Outlook\Addins\TeamsAddin.FastConnect\LoadBehavior#value
        
        Potential Persistence Via Visual Studio Tools for Office Sigma (inferred path)
        Office Autorun Keys Modification Sigma (inferred path)
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Office\Outlook\LoadMacroProviderOnBoot#value
        
        Windows Outlook LoadMacroProviderOnBoot Persistence Splunk (inferred path)
        Stored data is 0x00000001
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Office\Teams#
        
        Outlook Home Page Registry Modification Elastic Detection rule (inferred branch)
        Windows Outlook WebView Registry Modification Splunk (inferred branch)
      - HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\OneDrive#
        
        Lolbas OneDriveStandaloneUpdater.exe Proxy Download Sigma (inferred branch)
      - HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS#
        
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\CurrentVersion#
        
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer#
        
        Potentially Suspicious Command Executed Via Run Dialog Box - Registry Sigma (inferred branch)
        FileFix - Command Evidence in TypedPaths Sigma (inferred branch)
        Command Executed Via Run Dialog Box - Registry Sigma (inferred branch)
        Suspicious Space Characters in TypedPaths Registry Path - FileFix Sigma (inferred branch)
        Suspicious Space Characters in RunMRU Registry Path - ClickFix Sigma (inferred branch)
        Potential ClickFix Execution Pattern - Registry Sigma (inferred branch)
        Windows RunMRU Registry Key or Value Deleted Splunk (inferred branch)
        RunMRU Registry Key Deletion - Registry Sigma (inferred branch)
        Potential SharpRDP Behavior Elastic (inferred branch)
        Potential Persistence Via TypedPaths Sigma (inferred branch)
        
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\Advanced#
        
        Disable Show Hidden Files Splunk (inferred path)
        
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\Advanced\Hidden#value
        
        Registry Modification to Hidden File Extension Sigma (inferred path)
        Displaying Hidden Files Feature Disabled Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\Advanced\HideFileExt#value
        
        Registry Modification to Hidden File Extension Sigma (inferred path)
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\Advanced\ShowCompColor#value
        
        Windows Modify Show Compress Color And Info Tip Registry Splunk (inferred path)
        Registry Hide Function from User Sigma (inferred path)
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\Advanced\ShowInfoTip#value
        
        Registry Hide Function from User Sigma (inferred path)
        Windows Modify Show Compress Color And Info Tip Registry Splunk (inferred path)
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\Advanced\ShowSuperHidden#value
        
        Displaying Hidden Files Feature Disabled Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\CLSID#
        
        Forest Blizzard APT - Custom Protocol Handler DLL Registry Set Sigma (inferred branch)
        Malicious InProcServer32 Modification Splunk (inferred branch)
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\RecentDocs#
        
        Windows Phishing Recent ISO Exec Registry Splunk (inferred branch)
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\Shell Folders#
        
        Unusual Startup Shell Folder Modification Elastic (inferred branch)
        Suspicious Startup Shell Folder Modification Elastic (inferred branch)
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\ImmersiveShell#
        
        Windows Modify Registry Disable Windows Security Center Notif Splunk (inferred branch)
        Stored data is 0x00000000
        Disable Windows Security Center Notifications Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Internet Settings#
        
        Windows Modify Registry MaxConnectionPerServer Splunk (inferred path)
        Values: MaxConnectionsPer1_0Server or MaxConnectionsPerServer
        Stored data is 0x0000000a
        
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Internet Settings\AutoConfigURL#value
        
        Potential AutoConfigURL Settings Hijack Elastic (inferred path)
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Internet Settings\ProxyEnable#value
        
        Windows Modify Registry ProxyEnable Splunk (inferred path)
        Stored data is 0x00000001
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Internet Settings\ProxyServer#value
        
        Windows Modify Registry ProxyServer Splunk (inferred path)
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\PushNotifications#
        
        Windows Modify Registry Disable Toast Notifications Splunk (inferred branch)
        Stored data is 0x00000000
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Run#
        
        Registry Run Key Prefixed with Asterisk Elastic (inferred branch)
        Potential REMCOS Trojan Execution Elastic (inferred path)
        Values: Remcos or Rmc-??????
        
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Run\OneDrive#value
        
        Kapeka Backdoor Autorun Persistence Sigma (inferred path)
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\SHELL#
        
        Potential SentinelOne Shell Context Menu Scan Command Tampering Sigma (inferred branch)
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\Windows Error Reporting#
        
        Add Debugger Entry To Hangs Key For Persistence Sigma (inferred branch)
        Lsass Full Dump Request Via DumpType Registry Settings Sigma (inferred branch)
        Stored data is DWORD (0x00000002)
        
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\WINDOWS\Windows Error Reporting\DISABLED#value
        
        Windows Modify Registry Disabling WER Settings Splunk (inferred path)
        Stored data is 0x00000001
      - HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Windows NT\CurrentVersion#
        
        Suspicious Registry Symbolic Link Elastic (inferred path)
        
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags#
        
        Registry Keys for Creating SHIM Databases Splunk (inferred branch)
        Potential Persistence Via Shim Database Modification Sigma (inferred branch)
        
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store#
        
        UAC Bypass Using Windows Media Player - Registry Sigma (inferred branch)
        Stored data is Binary Data
        
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Program Files\WindowsApps\MSTeams_25332.1210.4188.1171_x64__8wekyb3d8bbwe\ms-teams.exe#value
        
        New Application in AppCompat Sigma (inferred path)
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers#
        
        Potential Persistence Via AppCompat RegisterAppRestart Layer Sigma (inferred path)
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WINDOWS#
        
        CurrentVersion NT Autorun Keys Modification Sigma (inferred path)
        Startup Persistence by a Low Reputation Process Elastic (inferred path)
        
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WINDOWS\Load#value
        
        Registry Persistence via Microsoft Office Descendant Process Elastic (inferred path)
        Registry Modification via Microsoft Office Elastic (inferred path)
        Persistence via a Process from a Removable or Mounted ISO Device Elastic (inferred path)
        Persistence via WMI Standard Registry Provider Elastic (inferred path)
        Startup Persistence from a Browser or Compression Utility Descendant Elastic (inferred path)
        Dual Persistence via Startup and Scheduled Task Elastic (inferred path)
        Untrusted Process Writing to Commonly Abused Persistence Locations Elastic (inferred path)
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon#
        
        Winlogon Notify Key Logon Persistence Sigma (inferred branch)
        Hiding User Account Via SpecialAccounts Registry Key Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
        Potential Persistence Via Mpnotify Sigma (inferred branch)
        Hide User Account From Sign-In Screen Splunk (inferred branch)
        Startup Persistence by a Low Reputation Process Elastic (inferred path)
        Winlogon AllowMultipleTSSessions Enable Sigma (inferred branch)
        
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultPassword#value
        
        Add DefaultUser And Password In Registry Splunk (inferred path)
        HKU\<CURRENT_USER_SID>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SHELL#value
        
        Persistence via a Process from a Removable or Mounted ISO Device Elastic (inferred path)
        Persistence via WMI Standard Registry Provider Elastic (inferred path)
        Startup Persistence from a Browser or Compression Utility Descendant Elastic (inferred path)
        Dual Persistence via Startup and Scheduled Task Elastic (inferred path)
        Untrusted Process Writing to Commonly Abused Persistence Locations Elastic (inferred path)
        Registry Persistence via Microsoft Office Descendant Process Elastic (inferred path)
        Registry Modification via Microsoft Office Elastic (inferred path)
    - HKU\<CURRENT_USER_SID>\SOFTWARE\Policies#
      
      DNS-over-HTTPS Enabled by Registry Sigma (inferred branch)
      DNS-over-HTTPS Enabled via Registry Elastic (inferred branch)
      - HKU\<CURRENT_USER_SID>\SOFTWARE\Policies\Microsoft#
        
        Suspicious Browser Files Modification Elastic (inferred branch)
        Disable Exploit Guard Network Protection on Windows Defender Sigma (inferred branch)
        Stored data is DWORD (00000001)
        Windows Modify Registry Disable WinDefender Notifications Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Impair Defense Disable Win Defender App Guard Splunk (inferred branch)
        Stored data is 0x00000000
        Windows Modify Registry Configure BitLocker Splunk (inferred branch)
        Disable Windows Firewall by Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
        
        HKU\<CURRENT_USER_SID>\SOFTWARE\Policies\Microsoft\WINDOWS#
        
        Windows Modify Registry USeWuServer Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Modify Registry Do Not Connect To Win Update Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Modify Registry Auto Minor Updates Splunk (inferred branch)
        Stored data is 0x00000000
        PowerShell Script Execution Policy Enabled Sigma (inferred branch)
        Stored data is DWORD (0x00000001)
        Windows Modify Registry No Auto Reboot With Logon User Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Impair Defense Deny Security Software With Applocker Splunk (inferred branch)
        Stored data is *Action\="Deny"*
        Windows Modify Registry Auto Update Notif Splunk (inferred branch)
        Stored data is 0x00000002
        Disable Privacy Settings Experience in Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
        Windows Modify Registry No Auto Update Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Modify Registry UpdateServiceUrlAlternate Splunk (inferred branch)
        Endpoint Security Evasion via Malicious AppLocker Deny Rules Elastic (inferred branch)
        Scripted Diagnostics Turn Off Check Enabled - Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000001)
        Windows Modify Registry WuServer Splunk (inferred branch)
        Potential PowerShell Execution Policy Tampering Sigma (inferred branch)
        Windows Modify Registry wuStatusServer Splunk (inferred branch)
        Windows Recall Feature Enabled - Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
        Disabling Windows Local Security Authority Defences via Registry Splunk (inferred branch)
        
        HKU\<CURRENT_USER_SID>\SOFTWARE\Policies\Microsoft\WINDOWS\Explorer#
        
        HKU\<CURRENT_USER_SID>\SOFTWARE\Policies\Microsoft\WINDOWS\Explorer\DisableNotificationCenter#value
        
        Disable Internal Tools or Feature in Registry Sigma (inferred path)
        Windows Disable Notification Center Splunk (inferred path)
- HKU\<CURRENT_USER_SID>_CLASSES#
  - HKU\<CURRENT_USER_SID>_CLASSES\CLSID#
    
    AMSI Bypass via COM Registry Modification Elastic (inferred branch)
    Component Object Model Registry Modification by a Low Reputation Process Elastic (inferred branch)
    Suspicious Component Object Model Registry Modification Elastic (inferred branch)
  - HKU\<CURRENT_USER_SID>_CLASSES\Local Settings\SOFTWARE\Microsoft#
    
    ETW Logging Disabled In .NET Processes - Sysmon Registry Sigma (inferred branch)
    NET NGenAssemblyUsageLog Registry Key Tamper Sigma (inferred branch)
    Set Default PowerShell Execution Policy To Unrestricted or Bypass Splunk (inferred branch)
  - HKU\<CURRENT_USER_SID>_CLASSES\TYPELIB#
    
    WaaSMedicSvc COM Type Lib Hijack Elastic (inferred branch)
- HKU\S-1-5-19#
  - HKU\S-1-5-19\CONSOLE#
    
    Windows Modify Registry ValleyRAT C2 Config Splunk (inferred branch)
  - HKU\S-1-5-19\Control Panel\Desktop#
    
    Screensaver Event Trigger Execution Splunk (inferred branch)
    ScreenSaver Registry Key Set Sigma (inferred branch)
  - HKU\S-1-5-19\SOFTWARE#
    - HKU\S-1-5-19\SOFTWARE\Microsoft#
      - HKU\S-1-5-19\SOFTWARE\Microsoft\EXEpath#value
        
        Remcos RAT ExePath Registry Modification Elastic (inferred path)
      - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main#
        
        Internet Explorer DisableFirstRunCustomize Enabled Sigma (inferred branch)
      - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion#
        
        Suspicious Registry Symbolic Link Elastic (inferred path)
      - HKU\S-1-5-19\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer#
        
        Potentially Suspicious Command Executed Via Run Dialog Box - Registry Sigma (inferred branch)
        FileFix - Command Evidence in TypedPaths Sigma (inferred branch)
        Command Executed Via Run Dialog Box - Registry Sigma (inferred branch)
        Suspicious Space Characters in TypedPaths Registry Path - FileFix Sigma (inferred branch)
        Suspicious Space Characters in RunMRU Registry Path - ClickFix Sigma (inferred branch)
        Potential ClickFix Execution Pattern - Registry Sigma (inferred branch)
        Windows RunMRU Registry Key or Value Deleted Splunk (inferred branch)
        RunMRU Registry Key Deletion - Registry Sigma (inferred branch)
        Potential SharpRDP Behavior Elastic (inferred branch)
        Potential Persistence Via TypedPaths Sigma (inferred branch)
        
        HKU\S-1-5-19\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\Shell Folders#
        
        Unusual Startup Shell Folder Modification Elastic (inferred branch)
        Suspicious Startup Shell Folder Modification Elastic (inferred branch)
    - HKU\S-1-5-19\SOFTWARE\Policies#
      
      DNS-over-HTTPS Enabled by Registry Sigma (inferred branch)
      DNS-over-HTTPS Enabled via Registry Elastic (inferred branch)
      - HKU\S-1-5-19\SOFTWARE\Policies\EXEpath#value
        
        Remcos RAT ExePath Registry Modification Elastic (inferred path)
      - HKU\S-1-5-19\SOFTWARE\Policies\Microsoft#
        
        Suspicious Browser Files Modification Elastic (inferred branch)
        Disable Exploit Guard Network Protection on Windows Defender Sigma (inferred branch)
        Stored data is DWORD (00000001)
        Windows Modify Registry Disable WinDefender Notifications Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Impair Defense Disable Win Defender App Guard Splunk (inferred branch)
        Stored data is 0x00000000
        Windows Modify Registry Configure BitLocker Splunk (inferred branch)
        Disable Windows Firewall by Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
        
        HKU\S-1-5-19\SOFTWARE\Policies\Microsoft\WINDOWS#
        
        Windows Modify Registry USeWuServer Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Modify Registry Do Not Connect To Win Update Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Modify Registry Auto Minor Updates Splunk (inferred branch)
        Stored data is 0x00000000
        Disabling Windows Local Security Authority Defences via Registry Splunk (inferred branch)
        PowerShell Script Execution Policy Enabled Sigma (inferred branch)
        Stored data is DWORD (0x00000001)
        Windows Modify Registry No Auto Reboot With Logon User Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Impair Defense Deny Security Software With Applocker Splunk (inferred branch)
        Stored data is *Action\="Deny"*
        Windows Modify Registry Auto Update Notif Splunk (inferred branch)
        Stored data is 0x00000002
        Disable Privacy Settings Experience in Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
        Windows Modify Registry No Auto Update Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Modify Registry UpdateServiceUrlAlternate Splunk (inferred branch)
        Endpoint Security Evasion via Malicious AppLocker Deny Rules Elastic (inferred branch)
        Scripted Diagnostics Turn Off Check Enabled - Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000001)
        Windows Modify Registry WuServer Splunk (inferred branch)
        Potential PowerShell Execution Policy Tampering Sigma (inferred branch)
        Windows Modify Registry wuStatusServer Splunk (inferred branch)
        Windows Recall Feature Enabled - Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
- HKU\S-1-5-20#
  - HKU\S-1-5-20\Console#
    
    Windows Modify Registry ValleyRAT C2 Config Splunk (inferred branch)
  - HKU\S-1-5-20\Control Panel\Desktop#
    
    Screensaver Event Trigger Execution Splunk (inferred branch)
    ScreenSaver Registry Key Set Sigma (inferred branch)
    - HKU\S-1-5-20\Control Panel\Desktop\WallPaper#value
      
      Potentially Suspicious Desktop Background Change Via Registry Sigma (inferred path)
      Modification Of Wallpaper Splunk (inferred path)
    - HKU\S-1-5-20\Control Panel\Desktop\WallpaperStyle#value
      
      Potentially Suspicious Desktop Background Change Via Registry Sigma (inferred path)
      Modification Of Wallpaper Splunk (inferred path)
  - HKU\S-1-5-20\Environment#
    
    Privilege Escalation via Windir Environment Variable Elastic (inferred branch)
    Windows Anomalous Registry Value Length in Environment Key Splunk (inferred path)
    Suspicious Environment Variable Has Been Registered Sigma (inferred path)
    Logon Script Event Trigger Execution Splunk (inferred branch)
    NET Profiler UAC bypass Splunk (inferred branch)
    Stored data is *.dll
    - HKU\S-1-5-20\Environment\COMPlus_ETWEnabled#value
      
      ETW Logging Disabled In .NET Processes - Registry Sigma (inferred path)
      Windows Registry Dotnet ETW Disabled Via ENV Variable Splunk (inferred path)
    - HKU\S-1-5-20\Environment\COMPlus_ETWFlags#value
      
      ETW Logging Disabled In .NET Processes - Registry Sigma (inferred path)
  - HKU\S-1-5-20\Keyboard Layout\Preload#
    - HKU\S-1-5-20\Keyboard Layout\Preload\1#value
      
      Suspicious Keyboard Layout Load Sigma (inferred path)
  - HKU\S-1-5-20\Software#
    
    Windows Modify Registry Qakbot Binary Data Registry Splunk (inferred path)
    Windows Modify Registry With MD5 Reg Key Name Splunk (inferred path)
    Stored data is Binary Data
    - HKU\S-1-5-20\Software\appdatalow#
      - HKU\S-1-5-20\Software\appdatalow\EXEpath#value
        
        Remcos RAT ExePath Registry Modification Elastic (inferred path)
    - HKU\S-1-5-20\Software\Google#
      
      Windows Chrome Auto-Update Disabled via Registry Splunk (inferred branch)
      - HKU\S-1-5-20\Software\Google\Chrome#
        
        Windows Chrome Extension Allowed Registry Modification Splunk (inferred branch)
        
        HKU\S-1-5-20\Software\Google\Chrome\NativeMessagingHosts\com.microsoft.browsercore#
        
        Browser Native Messaging Registry Modification Elastic (inferred path)
        
        HKU\S-1-5-20\Software\Google\Chrome\NativeMessagingHosts\com.microsoft.browsercore\(Default)#value
        
        Browser Native Messaging Registry Modification Elastic (inferred path)
      - HKU\S-1-5-20\Software\Google\EXEpath#value
        
        Remcos RAT ExePath Registry Modification Elastic (inferred path)
    - HKU\S-1-5-20\Software\Microsoft#
      - HKU\S-1-5-20\Software\Microsoft\EXEpath#value
        
        Remcos RAT ExePath Registry Modification Elastic (inferred path)
      - HKU\S-1-5-20\Software\Microsoft\Internet Explorer#
        
        HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main#
        
        Internet Explorer DisableFirstRunCustomize Enabled Sigma (inferred branch)
        HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Services#
        
        DHCP Callout DLL Installation Sigma (inferred branch)
        HKU\S-1-5-20\Software\Microsoft\Internet Explorer\URLSearchHooks#
        
        Common Autorun Keys Modification Sigma (inferred path)
      - HKU\S-1-5-20\Software\Microsoft\OneDrive#
        
        Lolbas OneDriveStandaloneUpdater.exe Proxy Download Sigma (inferred branch)
      - HKU\S-1-5-20\Software\Microsoft\Windows#
        
        HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion#
        
        Registry Run Keys - Suspicious Registry Run Keys Kusto (inferred path)
        VBScript Payload Stored in Registry Sigma (inferred path)
        Registry Keys Used For Persistence Splunk (inferred path)
        Suspicious Windows Script Downloaded from the Internet Elastic (inferred path)
        
        HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer#
        
        Potentially Suspicious Command Executed Via Run Dialog Box - Registry Sigma (inferred branch)
        FileFix - Command Evidence in TypedPaths Sigma (inferred branch)
        Command Executed Via Run Dialog Box - Registry Sigma (inferred branch)
        Suspicious Space Characters in TypedPaths Registry Path - FileFix Sigma (inferred branch)
        Suspicious Space Characters in RunMRU Registry Path - ClickFix Sigma (inferred branch)
        Potential ClickFix Execution Pattern - Registry Sigma (inferred branch)
        Windows RunMRU Registry Key or Value Deleted Splunk (inferred branch)
        RunMRU Registry Key Deletion - Registry Sigma (inferred branch)
        Suspicious Startup Shell Folder Modification Elastic (inferred branch)
        Potential SharpRDP Behavior Elastic (inferred branch)
        Potential Persistence Via TypedPaths Sigma (inferred branch)
        
        HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID#
        
        Malicious InProcServer32 Modification Splunk (inferred branch)
        HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders#
        
        Unusual Startup Shell Folder Modification Elastic (inferred branch)
        
        HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\!Do not use this registry key#value
        
        Registry Persistence via Microsoft Office Descendant Process Elastic (inferred path)
        Registry Modification via Microsoft Office Elastic (inferred path)
        HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders#
        
        Modify User Shell Folders Startup Value Chronicle (inferred path)
        Registry Persistence via Microsoft Office Descendant Process Elastic (inferred path)
        Registry Modification via Microsoft Office Elastic (inferred path)
        
        HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup#value
        
        Modify User Shell Folders Startup Value Sigma (inferred path)
        Unusual Startup Shell Folder Modification Elastic (inferred path)
        HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings#
        
        Network Activity from a Stomped Module Elastic (inferred path)
        Modification of IE Registry Settings Sigma (inferred path)
        HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\PushNotifications#
        
        Windows Modify Registry Disable Toast Notifications Splunk (inferred branch)
        Stored data is 0x00000000
        HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run#
        
        Registry Run Key Prefixed with Asterisk Elastic (inferred branch)
        Suspicious Remote Registry Modification Elastic (inferred path)
        New RUN Key Pointing to Suspicious Folder Sigma (inferred path)
        CurrentVersion Autorun Keys Modification Sigma (inferred path)
        Suspicious Powershell In Registry Run Keys Chronicle (inferred path)
        Suspicious PowerShell In Registry Run Keys Sigma (inferred path)
        Startup Persistence by a Low Reputation Process Elastic (inferred path)
        Detect Remote Access Software Usage Registry Splunk (inferred path)
        Potential REMCOS Trojan Execution Elastic (inferred path)
        Values: Remcos or Rmc-??????
        
        HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveSetup#value
        
        Persistence via a Process from a Removable or Mounted ISO Device Elastic (inferred path)
        Script Interpreter Process Writing to Commonly Abused Persistence Locations Elastic (inferred path)
        Persistence via WMI Standard Registry Provider Elastic (inferred path)
        Startup Persistence from a Browser or Compression Utility Descendant Elastic (inferred path)
        Registry Run Key Modified by Unusual Process Elastic (inferred path)
        New RUN Key Pointing to Suspicious Folder Sigma (inferred path)
        Small Sieve Malware Registry Persistence Sigma (inferred path)
        Startup Persistence via Windows Script Interpreter Elastic (inferred path)
        Suspicious PowerShell In Registry Run Keys Sigma (inferred path)
        Dual Persistence via Startup and Scheduled Task Elastic (inferred path)
        Untrusted Process Writing to Commonly Abused Persistence Locations Elastic (inferred path)
        Registry Persistence via Microsoft Office Descendant Process Elastic (inferred path)
        Startup Persistence from Backed RWX Memory Elastic (inferred path)
        Startup or Run Key Registry Modification Elastic (inferred path)
        Potential PlugX Registry Modification Elastic (inferred path)
        Suspicious Startup Persistence via a Windows Installer Elastic (inferred path)
        Registry Modification via Microsoft Office Elastic (inferred path)
        Persistence via a Windows Installer Elastic (inferred path)
        HKU\S-1-5-20\Software\Microsoft\Windows\Windows Error Reporting#
        
        Lsass Full Dump Request Via DumpType Registry Settings Sigma (inferred branch)
        Stored data is DWORD (0x00000002)
        
        HKU\S-1-5-20\Software\Microsoft\Windows\Windows Error Reporting\Hangs#
        
        Add Debugger Entry To Hangs Key For Persistence Sigma (inferred branch)
      - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion#
        
        Suspicious Registry Symbolic Link Elastic (inferred path)
        Suspicious Windows Script Downloaded from the Internet Elastic (inferred path)
    - HKU\S-1-5-20\Software\Policies#
      - HKU\S-1-5-20\Software\Policies\EXEpath#value
        
        Remcos RAT ExePath Registry Modification Elastic (inferred path)
      - HKU\S-1-5-20\Software\Policies\Microsoft#
        
        Suspicious Browser Files Modification Elastic (inferred branch)
        Disable Exploit Guard Network Protection on Windows Defender Sigma (inferred branch)
        Stored data is DWORD (00000001)
        Windows Modify Registry Disable WinDefender Notifications Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Impair Defense Disable Win Defender App Guard Splunk (inferred branch)
        Stored data is 0x00000000
        Windows Modify Registry Configure BitLocker Splunk (inferred branch)
        Disable Windows Firewall by Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
        
        HKU\S-1-5-20\Software\Policies\Microsoft\Windows#
        
        Windows Modify Registry USeWuServer Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Modify Registry Do Not Connect To Win Update Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Modify Registry Auto Minor Updates Splunk (inferred branch)
        Stored data is 0x00000000
        Disabling Windows Local Security Authority Defences via Registry Splunk (inferred branch)
        PowerShell Script Execution Policy Enabled Sigma (inferred branch)
        Stored data is DWORD (0x00000001)
        Windows Modify Registry No Auto Reboot With Logon User Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Impair Defense Deny Security Software With Applocker Splunk (inferred branch)
        Stored data is *Action\="Deny"*
        Windows Modify Registry Auto Update Notif Splunk (inferred branch)
        Stored data is 0x00000002
        Disable Privacy Settings Experience in Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
        Windows Modify Registry No Auto Update Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Modify Registry UpdateServiceUrlAlternate Splunk (inferred branch)
        Endpoint Security Evasion via Malicious AppLocker Deny Rules Elastic (inferred branch)
        Scripted Diagnostics Turn Off Check Enabled - Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000001)
        Windows Modify Registry WuServer Splunk (inferred branch)
        Potential PowerShell Execution Policy Tampering Sigma (inferred branch)
        Windows Modify Registry wuStatusServer Splunk (inferred branch)
        Windows Recall Feature Enabled - Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
      - HKU\S-1-5-20\Software\Policies\Power#
        
        Suspicious Browser Files Modification Elastic (inferred branch)
    - HKU\S-1-5-20\Software\VMware, Inc.#
      - HKU\S-1-5-20\Software\VMware, Inc.\EXEpath#value
        
        Remcos RAT ExePath Registry Modification Elastic (inferred path)
  - HKU\S-1-5-20\System\CurrentControlSet\Control#
    
    Disable Security Logs Using MiniNt Registry Splunk (inferred branch)
    - HKU\S-1-5-20\System\CurrentControlSet\Control\Network#
      
      Potential PlugX Registry Modification Elastic (inferred branch)
- HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes#
  
  UAC Bypass via DelegateExecute Registry Modification Elastic (inferred path)
  Suspicious Shell Extension Handler Registry Modification Elastic (inferred path)
  UAC Bypass via WSReset Execution Hijack Elastic (inferred path)
  Removal of Potential COM Hijacking Registry Keys Sigma (inferred path)
  Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace Sigma (inferred path)
  New File Association Using Exefile Sigma (inferred path)
  Stored data is exefile
  Bypass UAC Using DelegateExecute Sigma (inferred path)
  Stored data is (Empty)
  Suspicious Windows Script Downloaded from the Internet Elastic (inferred path)
  Suspicious Shell Open Command Registry Modification Sigma (inferred path)
  Custom File Open Handler Executes PowerShell Sigma (inferred path)
  - HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\.wav\OpenWithProgids#
    - HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\.wav\OpenWithProgids\AppXqj98qxeaynz6dv4459ayz6bnqxbyaqcs#value
      
      Windows Snake Malware Registry Modification wav OpenWithProgIds Splunk (inferred path)
  - HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\AppID#
    
    Suspicious Remote Registry Modification Elastic (inferred path)
  - HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\CLSID#
    
    Potential Microsoft Outlook Remote Code Execution Elastic (inferred path)
    Windows New InProcServer32 Added Splunk (inferred path)
    Component Object Model Registry Modification by a Low Reputation Process Elastic (inferred branch)
    Potential Persistence Via Scrobj.dll COM Hijacking Sigma (inferred path)
    Stored data is C:\WINDOWS\system32\scrobj.dll
    AMSI Bypass via COM Registry Modification Elastic (inferred branch)
    Startup Persistence via Windows Script Interpreter Elastic (inferred path)
    Windows InProcServer32 New Outlook Form Splunk (inferred path)
    Stored data is *\\FORMS\\*
    Suspicious Component Object Model Registry Modification Elastic (inferred branch)
    - HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder#
      
      Component Object Model Hijacking - Vault7 trick Kusto (inferred path)
  - HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\Extensions\ContractId#
    
    Windows Installer with Suspicious Properties Elastic (inferred path)
    - HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\Extensions\ContractId\Windows.Launch\PackageId\Microsoft.MicrosoftEdge_44.22621.1413.0_neutral__8wekyb3d8bbwe\ActivatableClassId\MicrosoftEdge#
      
      Windows Impair Defense Overide Win Defender Phishing Filter Splunk (inferred branch)
      Stored data is 0x00000000
  - HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\Local Settings\Software\Microsoft#
    
    Windows Modify Registry With MD5 Reg Key Name Splunk (inferred path)
    Stored data is Binary Data
    - HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\Local Settings\Software\Microsoft\EXEpath#value
      
      Remcos RAT ExePath Registry Modification Elastic (inferred path)
    - HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\Local Settings\Software\Microsoft\Windows#
      
      Windows Modify Registry Qakbot Binary Data Registry Splunk (inferred path)
      - HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion#
        
        VBScript Payload Stored in Registry Sigma (inferred path)
        Windows Installer with Suspicious Properties Elastic (inferred path)
        Suspicious Windows Script Downloaded from the Internet Elastic (inferred path)
        
        HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage#
        
        Registry Modification from a Potentially Altered Call Stack Elastic (inferred path)
        Potential Hardware Breakpoints Evasion Elastic (inferred path)
        
        HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy#
        
        HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\MicrosoftEdge#
        
        Windows Impair Defense Overide Win Defender Phishing Filter Splunk (inferred branch)
        Stored data is 0x00000000
        HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Software\Microsoft\SystemCertificates\CA\Certificates\E7EEA674CA718E3BEFD90858E09F8372AD0AE2AA#
        
        Windows Registry Certificate Added Splunk (inferred path)
        New Root or CA or AuthRoot Certificate to Store Sigma (inferred path)
        Stored data is Binary Data
        HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel#
        
        HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages#
        
        HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftEdge_44.22621.1413.0_neutral__8wekyb3d8bbwe\MicrosoftEdge#
        
        Windows Impair Defense Overide Win Defender Phishing Filter Splunk (inferred branch)
        Stored data is 0x00000000
        HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_22204.1400.4.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations#
        
        UAC Bypass via WSReset Execution Hijack Elastic (inferred path)
        HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\HAM\AUI\MicrosoftEdge#
        
        Windows Impair Defense Overide Win Defender Phishing Filter Splunk (inferred branch)
        Stored data is 0x00000000
  - HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\ms-windows-store#
  - HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\ms-windows-store2#
  - HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\ms-windows-store-deskext#
    
    UAC Bypass via WSReset Execution Hijack Elastic (inferred path)
  - HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\TypeLib#
    
    WaaSMedicSvc COM Type Lib Hijack Elastic (inferred branch)
  - HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\WOW6432Node\CLSID#
    
    Windows New InProcServer32 Added Splunk (inferred path)
    Potential Persistence Via Scrobj.dll COM Hijacking Sigma (inferred path)
    Stored data is C:\WINDOWS\system32\scrobj.dll
    Startup Persistence via Windows Script Interpreter Elastic (inferred path)
    Windows InProcServer32 New Outlook Form Splunk (inferred path)
    Stored data is *\\FORMS\\*
    - HKU\S-1-5-21-973394255-3265199611-3641254755-1001_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder#
      
      Component Object Model Hijacking - Vault7 trick Kusto (inferred path)
HKCR #

Potential Persistence Via Custom Protocol Handler Sigma (inferred path)
Windows New Default File Association Value Set Splunk (inferred path)
Windows Modify Registry Default Icon Setting Splunk (inferred path)
- HKCR\.pwn\Shell\Open\command#
  
  Windows Modify Registry ValleyRat PWN Reg Entry Splunk (inferred path)
- HKCR\ActivatableClasses\Package#
  
  Potential Persistence Using DebugPath Sigma (inferred path)
- HKCR\AppX3bbba44c6cae4d9695755183472171e2#
  
  OceanLotus Registry Activity Sigma (inferred path)
- HKCR\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open#
  
  WSReset UAC Bypass Splunk (inferred path)
  - HKCR\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command#
    
    UAC Bypass Via Wsreset Sigma (inferred path)
- HKCR\AppXc52346ec40fb4061ad96be0e6cb7d16a#
  
  OceanLotus Registry Activity Sigma (inferred path)
- HKCR\AppXypsaf9f1qserqevf0sws76dx4k9a5206\Shell\open\command#
  - HKCR\AppXypsaf9f1qserqevf0sws76dx4k9a5206\Shell\open\command\(Default)#
    
    Narrator's Feedback-Hub Persistence Sigma (inferred path)
  - HKCR\AppXypsaf9f1qserqevf0sws76dx4k9a5206\Shell\open\command\DelegateExecute#
    
    Narrator's Feedback-Hub Persistence Sigma (inferred path)
- HKCR\CLSID#
  - HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell#
    - HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open#
      
      Registry Persistence Mechanisms in Recycle Bin Sigma (inferred path)
    - HKCR\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open\command\(Default)#
      
      Registry Persistence Mechanisms in Recycle Bin Sigma (inferred path)
  - HKCR\CLSID\{E08A0F4B-1F65-4D4D-9A09-BD4625B9C5A1}\Model#
    
    OceanLotus Registry Activity Sigma (inferred path)
  - HKCR\CLSID\{E3517E26-8E93-458D-A6DF-8030BC80528B}#
    
    OceanLotus Registry Activity Sigma (inferred path)
- HKCR\exefile\shell\open\command\(Default)#
  
  Shell Open Registry Keys Manipulation Sigma (inferred path)
- HKCR\ms-msdt#
  
  Suspicious Set Value of MSDT in Registry (CVE-2022-30190) Sigma (path prefix)
- HKCR\ms-settings\shell\open\command#
  - HKCR\ms-settings\shell\open\command\(Default)#
    
    Shell Open Registry Keys Manipulation Sigma (inferred path)
  - HKCR\ms-settings\shell\open\command\DelegateExecute#
    
    Shell Open Registry Keys Manipulation Sigma (inferred path)
  - HKCR\ms-settings\shell\open\command\SymbolicLinkValue#
    
    Shell Open Registry Keys Manipulation Sigma (inferred path)
Native registry paths

\Registry#
- \Registry\A#
  
  Winget Admin Settings Modification Sigma (path prefix)
- \Registry\WC#
  - \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID#
    - \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID\Control Panel\Desktop#
      
      Screensaver Event Trigger Execution Splunk (inferred branch)
      ScreenSaver Registry Key Set Sigma (inferred branch)
    - \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID\Keyboard Layout\Substitutes#
      - \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID\Keyboard Layout\Substitutes\00000409#value
        
        Suspicious Keyboard Layout Load Sigma (inferred path)
    - \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID\SOFTWARE#
      - \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID\SOFTWARE\Microsoft#
        
        \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID\SOFTWARE\Microsoft\Edge#
        
        Windows Impair Defense Override SmartScreen Prompt Splunk (inferred branch)
        Stored data is 0x00000000
        \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID\SOFTWARE\Microsoft\Internet Explorer\Main#
        
        Internet Explorer DisableFirstRunCustomize Enabled Sigma (inferred branch)
        \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID\SOFTWARE\Microsoft\OneDrive#
        
        Lolbas OneDriveStandaloneUpdater.exe Proxy Download Sigma (inferred branch)
        \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID\SOFTWARE\Microsoft\Windows NT\CurrentVersion#
        
        Potential Credential Dumping Via LSASS SilentProcessExit Technique Chronicle (inferred branch)
        
        \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags#
        
        Registry Keys for Creating SHIM Databases Splunk (inferred branch)
        Potential Persistence Via Shim Database Modification Sigma (inferred branch)
        
        \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers#
        
        Potential Persistence Via AppCompat RegisterAppRestart Layer Sigma (inferred path)
        \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer#
        
        FileFix - Command Evidence in TypedPaths Sigma (inferred branch)
        Suspicious Space Characters in TypedPaths Registry Path - FileFix Sigma (inferred branch)
        Suspicious Space Characters in RunMRU Registry Path - ClickFix Sigma (inferred branch)
        Potential ClickFix Execution Pattern - Registry Sigma (inferred branch)
        Windows RunMRU Registry Key or Value Deleted Splunk (inferred branch)
        RunMRU Registry Key Deletion - Registry Sigma (inferred branch)
        Potential Persistence Via TypedPaths Sigma (inferred branch)
        
        \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\CLSID#
        
        Malicious InProcServer32 Modification Splunk (inferred branch)
        Forest Blizzard APT - Custom Protocol Handler DLL Registry Set Sigma (inferred branch)
      - \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID\SOFTWARE\Policies#
        
        DNS-over-HTTPS Enabled by Registry Sigma (inferred branch)
        DNS-over-HTTPS Enabled via Registry Elastic (inferred branch)
        
        \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID\SOFTWARE\Policies\Microsoft#
        
        Disable Exploit Guard Network Protection on Windows Defender Sigma (inferred branch)
        Stored data is DWORD (00000001)
        Windows Modify Registry Disable WinDefender Notifications Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Impair Defense Disable Win Defender App Guard Splunk (inferred branch)
        Stored data is 0x00000000
        Windows Modify Registry Configure BitLocker Splunk (inferred branch)
        Disable Windows Firewall by Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
        
        \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID\SOFTWARE\Policies\Microsoft\WINDOWS#
        
        Windows Modify Registry USeWuServer Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Modify Registry Do Not Connect To Win Update Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Modify Registry Auto Minor Updates Splunk (inferred branch)
        Stored data is 0x00000000
        PowerShell Script Execution Policy Enabled Sigma (inferred branch)
        Stored data is DWORD (0x00000001)
        Windows Modify Registry No Auto Reboot With Logon User Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Impair Defense Deny Security Software With Applocker Splunk (inferred branch)
        Stored data is *Action\="Deny"*
        Windows Modify Registry Auto Update Notif Splunk (inferred branch)
        Stored data is 0x00000002
        Disable Privacy Settings Experience in Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
        Windows Modify Registry No Auto Update Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Modify Registry UpdateServiceUrlAlternate Splunk (inferred branch)
        Scripted Diagnostics Turn Off Check Enabled - Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000001)
        Windows Modify Registry WuServer Splunk (inferred branch)
        Potential PowerShell Execution Policy Tampering Sigma (inferred branch)
        Windows Modify Registry wuStatusServer Splunk (inferred branch)
        Windows Recall Feature Enabled - Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
      - \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID\SOFTWARE\WOW6432Node\Microsoft\Office\Outlook#
        
        Windows Outlook Dialogs Disabled from Unusual Process Splunk (inferred branch)
        Outlook Macro Execution Without Warning Setting Enabled Sigma (inferred branch)
        Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting Sigma (inferred branch)
        Outlook EnableUnsafeClientMailRules Setting Enabled - Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000001)
        Windows Outlook Macro Security Modified Splunk (inferred branch)
        Stored data is 0x00000001
        
        \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID\SOFTWARE\WOW6432Node\Microsoft\Office\Outlook\Addins\TeamsAddin.FastConnect#
        
        Office Autorun Keys Modification Sigma (inferred path)
        
        \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID\SOFTWARE\WOW6432Node\Microsoft\Office\Outlook\Addins\TeamsAddin.FastConnect\LoadBehavior#value
        
        Office Autorun Keys Modification Sigma (inferred path)
        \Registry\WC\SILO97BD65C1-E8E0-C76E-3B9E-309AFABF1315USER_SID\SOFTWARE\WOW6432Node\Microsoft\Office\Outlook\LoadMacroProviderOnBoot#value
        
        Windows Outlook LoadMacroProviderOnBoot Persistence Splunk (inferred path)
        Stored data is 0x00000001
  - \Registry\WC\SILOB04FC3BC-ED56-586E-C6A2-C7D436B49F47USER_CLASSES#
    
    Bypass UAC Using Event Viewer Sigma (inferred branch)
  - \Registry\WC\SILOB04FC3BC-ED56-586E-C6A2-C7D436B49F47USER_SID#
    - \Registry\WC\SILOB04FC3BC-ED56-586E-C6A2-C7D436B49F47USER_SID\Control Panel\Desktop#
      
      Screensaver Event Trigger Execution Splunk (inferred branch)
      ScreenSaver Registry Key Set Sigma (inferred branch)
    - \Registry\WC\SILOB04FC3BC-ED56-586E-C6A2-C7D436B49F47USER_SID\SOFTWARE#
      - \Registry\WC\SILOB04FC3BC-ED56-586E-C6A2-C7D436B49F47USER_SID\SOFTWARE\Microsoft#
        
        \Registry\WC\SILOB04FC3BC-ED56-586E-C6A2-C7D436B49F47USER_SID\SOFTWARE\Microsoft\Internet Explorer\Main#
        
        Internet Explorer DisableFirstRunCustomize Enabled Sigma (inferred branch)
        \Registry\WC\SILOB04FC3BC-ED56-586E-C6A2-C7D436B49F47USER_SID\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer#
        
        FileFix - Command Evidence in TypedPaths Sigma (inferred branch)
        Suspicious Space Characters in TypedPaths Registry Path - FileFix Sigma (inferred branch)
        Suspicious Space Characters in RunMRU Registry Path - ClickFix Sigma (inferred branch)
        Potential ClickFix Execution Pattern - Registry Sigma (inferred branch)
        Windows RunMRU Registry Key or Value Deleted Splunk (inferred branch)
        RunMRU Registry Key Deletion - Registry Sigma (inferred branch)
        Potential Persistence Via TypedPaths Sigma (inferred branch)
        
        \Registry\WC\SILOB04FC3BC-ED56-586E-C6A2-C7D436B49F47USER_SID\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\Advanced#
        
        Disable Show Hidden Files Splunk (inferred path)
        
        \Registry\WC\SILOB04FC3BC-ED56-586E-C6A2-C7D436B49F47USER_SID\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\Advanced\Hidden#value
        
        Registry Modification to Hidden File Extension Sigma (inferred path)
        Displaying Hidden Files Feature Disabled Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        \Registry\WC\SILOB04FC3BC-ED56-586E-C6A2-C7D436B49F47USER_SID\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\Advanced\HideFileExt#value
        
        Registry Modification to Hidden File Extension Sigma (inferred path)
        \Registry\WC\SILOB04FC3BC-ED56-586E-C6A2-C7D436B49F47USER_SID\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\Advanced\ShowCompColor#value
        
        Registry Hide Function from User Sigma (inferred path)
        Windows Modify Show Compress Color And Info Tip Registry Splunk (inferred path)
        \Registry\WC\SILOB04FC3BC-ED56-586E-C6A2-C7D436B49F47USER_SID\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\Advanced\ShowInfoTip#value
        
        Registry Hide Function from User Sigma (inferred path)
        Windows Modify Show Compress Color And Info Tip Registry Splunk (inferred path)
        \Registry\WC\SILOB04FC3BC-ED56-586E-C6A2-C7D436B49F47USER_SID\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\Advanced\ShowSuperHidden#value
        
        Displaying Hidden Files Feature Disabled Sigma (inferred path)
        Stored data is DWORD (0x00000000)
      - \Registry\WC\SILOB04FC3BC-ED56-586E-C6A2-C7D436B49F47USER_SID\SOFTWARE\Policies#
        
        DNS-over-HTTPS Enabled by Registry Sigma (inferred branch)
        DNS-over-HTTPS Enabled via Registry Elastic (inferred branch)
        
        \Registry\WC\SILOB04FC3BC-ED56-586E-C6A2-C7D436B49F47USER_SID\SOFTWARE\Policies\Microsoft#
        
        Disable Exploit Guard Network Protection on Windows Defender Sigma (inferred branch)
        Stored data is DWORD (00000001)
        Windows Modify Registry Disable WinDefender Notifications Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Impair Defense Disable Win Defender App Guard Splunk (inferred branch)
        Stored data is 0x00000000
        Windows Modify Registry Configure BitLocker Splunk (inferred branch)
        Disable Windows Firewall by Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
        
        \Registry\WC\SILOB04FC3BC-ED56-586E-C6A2-C7D436B49F47USER_SID\SOFTWARE\Policies\Microsoft\WINDOWS#
        
        Windows Modify Registry USeWuServer Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Modify Registry Do Not Connect To Win Update Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Modify Registry Auto Minor Updates Splunk (inferred branch)
        Stored data is 0x00000000
        PowerShell Script Execution Policy Enabled Sigma (inferred branch)
        Stored data is DWORD (0x00000001)
        Windows Modify Registry No Auto Reboot With Logon User Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Impair Defense Deny Security Software With Applocker Splunk (inferred branch)
        Stored data is *Action\="Deny"*
        Windows Modify Registry Auto Update Notif Splunk (inferred branch)
        Stored data is 0x00000002
        Disable Privacy Settings Experience in Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
        Windows Modify Registry No Auto Update Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Modify Registry UpdateServiceUrlAlternate Splunk (inferred branch)
        Scripted Diagnostics Turn Off Check Enabled - Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000001)
        Windows Modify Registry WuServer Splunk (inferred branch)
        Potential PowerShell Execution Policy Tampering Sigma (inferred branch)
        Windows Modify Registry wuStatusServer Splunk (inferred branch)
        Windows Recall Feature Enabled - Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
  - \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_CLASSES#
    
    Bypass UAC Using Event Viewer Sigma (inferred branch)
  - \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID#
    - \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\Control Panel\Desktop#
      
      Screensaver Event Trigger Execution Splunk (inferred branch)
      ScreenSaver Registry Key Set Sigma (inferred branch)
    - \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\Keyboard Layout\Substitutes#
      - \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\Keyboard Layout\Substitutes\00000409#value
        
        Suspicious Keyboard Layout Load Sigma (inferred path)
    - \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE#
      - \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Microsoft#
        
        \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Microsoft\Edge#
        
        Windows Impair Defense Override SmartScreen Prompt Splunk (inferred branch)
        Stored data is 0x00000000
        \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Microsoft\Internet Explorer\Main#
        
        Internet Explorer DisableFirstRunCustomize Enabled Sigma (inferred branch)
        \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Microsoft\OneDrive#
        
        Lolbas OneDriveStandaloneUpdater.exe Proxy Download Sigma (inferred branch)
        \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Microsoft\Windows NT\CurrentVersion#
        
        Potential Credential Dumping Via LSASS SilentProcessExit Technique Chronicle (inferred branch)
        
        \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags#
        
        Registry Keys for Creating SHIM Databases Splunk (inferred branch)
        Potential Persistence Via Shim Database Modification Sigma (inferred branch)
        
        \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers#
        
        Potential Persistence Via AppCompat RegisterAppRestart Layer Sigma (inferred path)
        \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Microsoft\WINDOWS\CurrentVersion#
        
        \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer#
        
        FileFix - Command Evidence in TypedPaths Sigma (inferred branch)
        Suspicious Space Characters in TypedPaths Registry Path - FileFix Sigma (inferred branch)
        Suspicious Space Characters in RunMRU Registry Path - ClickFix Sigma (inferred branch)
        Potential ClickFix Execution Pattern - Registry Sigma (inferred branch)
        Windows RunMRU Registry Key or Value Deleted Splunk (inferred branch)
        RunMRU Registry Key Deletion - Registry Sigma (inferred branch)
        Potential Persistence Via TypedPaths Sigma (inferred branch)
        
        \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\Advanced#
        
        Disable Show Hidden Files Splunk (inferred path)
        
        \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\Advanced\Hidden#value
        
        Registry Modification to Hidden File Extension Sigma (inferred path)
        Displaying Hidden Files Feature Disabled Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\Advanced\HideFileExt#value
        
        Registry Modification to Hidden File Extension Sigma (inferred path)
        \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\Advanced\ShowCompColor#value
        
        Registry Hide Function from User Sigma (inferred path)
        Windows Modify Show Compress Color And Info Tip Registry Splunk (inferred path)
        \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\Advanced\ShowInfoTip#value
        
        Registry Hide Function from User Sigma (inferred path)
        Windows Modify Show Compress Color And Info Tip Registry Splunk (inferred path)
        \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Explorer\Advanced\ShowSuperHidden#value
        
        Displaying Hidden Files Feature Disabled Sigma (inferred path)
        Stored data is DWORD (0x00000000)
        \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Internet Settings#
        
        Windows Modify Registry MaxConnectionPerServer Splunk (inferred path)
        Values: MaxConnectionsPer1_0Server or MaxConnectionsPerServer
        Stored data is 0x0000000a
        
        \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Internet Settings\ProxyEnable#value
        
        Windows Modify Registry ProxyEnable Splunk (inferred path)
        Stored data is 0x00000001
        \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Microsoft\WINDOWS\CurrentVersion\Internet Settings\ProxyServer#value
        
        Windows Modify Registry ProxyServer Splunk (inferred path)
      - \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Policies#
        
        DNS-over-HTTPS Enabled by Registry Sigma (inferred branch)
        DNS-over-HTTPS Enabled via Registry Elastic (inferred branch)
        
        \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Policies\Microsoft#
        
        Disable Exploit Guard Network Protection on Windows Defender Sigma (inferred branch)
        Stored data is DWORD (00000001)
        Windows Modify Registry Disable WinDefender Notifications Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Impair Defense Disable Win Defender App Guard Splunk (inferred branch)
        Stored data is 0x00000000
        Windows Modify Registry Configure BitLocker Splunk (inferred branch)
        Disable Windows Firewall by Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
        
        \Registry\WC\SILOE8BB395E-8543-4725-80BE-B249432F28B1USER_SID\SOFTWARE\Policies\Microsoft\WINDOWS#
        
        Windows Modify Registry USeWuServer Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Modify Registry Do Not Connect To Win Update Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Modify Registry Auto Minor Updates Splunk (inferred branch)
        Stored data is 0x00000000
        PowerShell Script Execution Policy Enabled Sigma (inferred branch)
        Stored data is DWORD (0x00000001)
        Windows Modify Registry No Auto Reboot With Logon User Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Impair Defense Deny Security Software With Applocker Splunk (inferred branch)
        Stored data is *Action\="Deny"*
        Windows Modify Registry Auto Update Notif Splunk (inferred branch)
        Stored data is 0x00000002
        Disable Privacy Settings Experience in Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000000)
        Windows Modify Registry No Auto Update Splunk (inferred branch)
        Stored data is 0x00000001
        Windows Modify Registry UpdateServiceUrlAlternate Splunk (inferred branch)
        Scripted Diagnostics Turn Off Check Enabled - Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000001)
        Windows Modify Registry WuServer Splunk (inferred branch)
        Potential PowerShell Execution Policy Tampering Sigma (inferred branch)
        Windows Modify Registry wuStatusServer Splunk (inferred branch)
        Windows Recall Feature Enabled - Registry Sigma (inferred branch)
        Stored data is DWORD (0x00000000)