Elastic Defend high stable eql

Attempt to Disable Windows Driver Blocklist via Registry

Identifies registry modifications to disable Microsoft policy that prevents a blacklist of known vulnerable drivers. This could be indicative of adversary defense evasion by attempting to load and exploit a vulnerable driver.

View Source

Detection Logic

registry where registry.path : "HKLM\\SYSTEM\\*ControlSet*\\CI\\Config\\VulnerableDriverBlocklistEnable" and
 registry.data.strings : "0" and
 not process.executable : ("?:\\Windows\\System32\\SecurityHealthService.exe",
                           "C:\\Program Files (x86)\\Common Files\\InstallShield\\engine\\?\\Intel 32\\IKernel.exe")

Field Validations

Loading…

Comments (0)

Loading comments...