diff --git a/rules/windows/registry_set/registry_set_disable_system_restore.yml b/rules/windows/registry_set/registry_set_disable_system_restore.yml index d5ab48b01..ba9829770 100644 --- a/rules/windows/registry_set/registry_set_disable_system_restore.yml +++ b/rules/windows/registry_set/registry_set_disable_system_restore.yml @@ -1,6 +1,6 @@ -title: Disable System Restore Through Registry +title: Registry Disable System Restore id: 5de03871-5d46-4539-a82d-3aa992a69a83 -description: Modify the registry to disable system restore on the computer +description: Detects the modification of the registry to disable a system restore on the computer author: frack113 date: 2022/04/04 status: experimental @@ -21,7 +21,7 @@ detection: condition: selection falsepositives: - Unknown -level: medium +level: high tags: - attack.impact - attack.t1490