Mohamed Ashraf c48c992f70 Update registry_set_disable_windows_event_log_access.yml

2025-08-06 11:20:57 +03:00

..

registry_set_add_load_service_in_safe_mode.yml

Merge PR #5177 from @nasbench - promote older rules status from experimental to test

2025-02-03 18:23:12 +01:00

registry_set_add_port_monitor.yml

Merge PR #5177 from @nasbench - promote older rules status from experimental to test

2025-02-03 18:23:12 +01:00

registry_set_aedebug_persistence.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_allow_rdp_remote_assistance_feature.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_amsi_com_hijack.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_asep_reg_keys_modification_classes.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_asep_reg_keys_modification_common.yml

Merge PR #5485 from @gregorywychowaniec-zt - Update registry_set rules to add 64 bits Program Files directory in filters

2025-06-16 13:42:00 +02:00

registry_set_asep_reg_keys_modification_currentcontrolset.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_asep_reg_keys_modification_currentversion_nt.yml

Merge PR #5513 from @swachchhanda000 - fix FPs observed via Aurora

2025-07-08 10:29:01 +02:00

registry_set_asep_reg_keys_modification_currentversion.yml

Merge PR #5485 from @gregorywychowaniec-zt - Update registry_set rules to add 64 bits Program Files directory in filters

2025-06-16 13:42:00 +02:00

registry_set_asep_reg_keys_modification_internet_explorer.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_asep_reg_keys_modification_office.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_asep_reg_keys_modification_session_manager.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_asep_reg_keys_modification_system_scripts.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_asep_reg_keys_modification_winsock2.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_asep_reg_keys_modification_wow6432node_classes.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_asep_reg_keys_modification_wow6432node_currentversion.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_asep_reg_keys_modification_wow6432node.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_bginfo_custom_db.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_bginfo_custom_vbscript.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_bginfo_custom_wmi_query.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_blackbyte_ransomware.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_bypass_uac_using_delegateexecute.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_bypass_uac_using_eventviewer.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_bypass_uac_using_silentcleanup_task.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_change_rdp_port.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_change_security_zones.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_change_sysmon_driver_altitude.yml

Merge PR #5177 from @nasbench - promote older rules status from experimental to test

2025-02-03 18:23:12 +01:00

registry_set_change_winevt_channelaccess.yml

Merge PR #5177 from @nasbench - promote older rules status from experimental to test

2025-02-03 18:23:12 +01:00

registry_set_chrome_extension.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_clickonce_trust_prompt.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_cobaltstrike_service_installs.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_comhijack_sdclt.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_crashdump_disabled.yml

Merge PR #5395 from @david-syk - Update MITRE ATT&CK tags

2025-05-20 23:05:21 +02:00

registry_set_creation_service_susp_folder.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_custom_file_open_handler_powershell_execution.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_dbgmanageddebugger_persistence.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_defender_exclusions.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_desktop_background_change.yml

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

registry_set_devdrv_disallow_antivirus_filter.yml

Merge PR #5506 from @nasbench -promote older rules status from experimental to test

2025-07-01 10:34:38 +02:00

registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.yml

Merge PR #5397 from @nasbench - Promote older rules status from experimental to test

2025-05-20 22:58:46 +02:00

registry_set_deviceguard_hypervisorenforcedpagingtranslation_disabled.yml

Merge PR #5397 from @nasbench - Promote older rules status from experimental to test

2025-05-20 22:58:46 +02:00

registry_set_dhcp_calloutdll.yml

Merge PR #5418 from @frack113 - chore: 🧹 Update MITRE V17 DLL tags

2025-05-15 12:17:10 +02:00

registry_set_disable_administrative_share.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_disable_autologger_sessions.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_disable_defender_firewall.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_disable_function_user.yml

Merge PR #5412 from @swachchhanda000 - feat: add more susp registry modifications associated with feature change of windows internal tools

2025-06-11 11:25:45 +02:00

registry_set_disable_macroruntimescanscope.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_disable_privacy_settings_experience.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_disable_security_center_notifications.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_disable_system_restore.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_disable_windows_defender_service.yml

Merge PR #5177 from @nasbench - promote older rules status from experimental to test

2025-02-03 18:23:12 +01:00

registry_set_disable_windows_event_log_access.yml

Update registry_set_disable_windows_event_log_access.yml

2025-08-06 11:20:57 +03:00

registry_set_disable_windows_firewall.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_disable_winevt_logging.yml

Merge PR #5177 from @nasbench - promote older rules status from experimental to test

2025-02-03 18:23:12 +01:00

registry_set_disabled_exploit_guard_net_protection_on_ms_defender.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_disabled_microsoft_defender_eventlog.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_disabled_pua_protection_on_microsoft_defender.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_disabled_tamper_protection_on_microsoft_defender.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_disallowrun_execution.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_disk_cleanup_handler_autorun_persistence.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_dns_over_https_enabled.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_dns_server_level_plugin_dll.yml

Merge PR #5418 from @frack113 - chore: 🧹 Update MITRE V17 DLL tags

2025-05-15 12:17:10 +02:00

registry_set_dot_net_etw_tamper.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_dsrm_tampering.yml

Merge PR #5448 from @nasbench - Promote older rules status from experimental to test

2025-06-02 13:29:48 +02:00

registry_set_enable_periodic_backup.yml

Merge PR #5397 from @nasbench - Promote older rules status from experimental to test

2025-05-20 22:58:46 +02:00

registry_set_enable_windows_recall.yml

Merge PR #5249 from @nasbench - Promote older rules status from experimental to test

2025-04-17 00:41:35 +02:00

registry_set_enabling_cor_profiler_env_variables.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_enabling_turnoffcheck.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_evtx_file_key_tamper.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_exploit_guard_susp_allowed_apps.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_fax_change_service_user.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_fax_dll_persistance.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_file_association_exefile.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_filefix_typedpath_commands.yml

Merge PR #5514 from @ajpc500 - Add Filefix TypedPaths Registry rule

2025-07-08 10:09:51 +02:00

registry_set_hangs_debugger_persistence.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_hhctrl_persistence.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_hidden_extention.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_hide_file.yml

Merge PR #5177 from @nasbench - promote older rules status from experimental to test

2025-02-03 18:23:12 +01:00

registry_set_hide_function_user.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_hide_scheduled_task_via_index_tamper.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_hvci_disallowed_images.yml

Merge PR #5506 from @nasbench -promote older rules status from experimental to test

2025-07-01 10:34:38 +02:00

registry_set_ie_security_zone_protocol_defaults_downgrade.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_ime_non_default_extension.yml

Merge PR #5027 from @nasbench - Promote older rules status from experimental to test

2024-10-01 14:56:09 +02:00

registry_set_ime_suspicious_paths.yml

Merge PR #5027 from @nasbench - Promote older rules status from experimental to test

2024-10-01 14:56:09 +02:00

registry_set_install_root_or_ca_certificat.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_internet_explorer_disable_first_run_customize.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_legalnotice_susp_message.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_lolbin_onedrivestandaloneupdater.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_lsa_disablerestrictedadmin.yml

Merge PR #4961 from @tsale - Add multiples rules and updates

2024-08-29 19:21:47 +02:00

registry_set_lsass_usermode_dumping.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_mal_blue_mockingbird.yml

Merge PR #5395 from @david-syk - Update MITRE ATT&CK tags

2025-05-20 23:05:21 +02:00

registry_set_net_cli_ngenassemblyusagelog.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_netsh_help_dll_persistence_susp_location.yml

Merge PR #5027 from @nasbench - Promote older rules status from experimental to test

2024-10-01 14:56:09 +02:00

registry_set_netsh_helper_dll_potential_persistence.yml

Merge PR #5027 from @nasbench - Promote older rules status from experimental to test

2024-10-01 14:56:09 +02:00

registry_set_new_application_appcompat.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_new_network_provider.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_odbc_driver_registered_susp.yml

Merge PR #5452 from @david-syk - Update the MITRE ATT&CK tags for multiple rules

2025-06-04 14:39:25 +02:00

registry_set_odbc_driver_registered.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_office_access_vbom_tamper.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_office_disable_protected_view_features.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_office_disable_python_security_warnings.yml

Merge PR #4961 from @tsale - Add multiples rules and updates

2024-08-29 19:21:47 +02:00

registry_set_office_enable_dde.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_office_outlook_enable_load_macro_provider_on_boot.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_office_outlook_enable_macro_execution.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_office_outlook_enable_unsafe_client_mail_rules.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_office_outlook_security_settings.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_office_trust_record_susp_location.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_office_trusted_location_uncommon.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_office_vba_warnings_tamper.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_optimize_file_sharing_network.yml

Merge PR #5177 from @nasbench - promote older rules status from experimental to test

2025-02-03 18:23:12 +01:00

registry_set_persistence_app_cpmpat_layer_registerapprestart.yml

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

registry_set_persistence_app_paths.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_persistence_appx_debugger.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_persistence_autodial_dll.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_persistence_chm.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_persistence_com_hijacking_builtin.yml

Merge PR #5508 by @X-Junior - add CLSIDs to COM Object Hijacking

2025-07-01 11:47:23 +02:00

registry_set_persistence_comhijack_psfactorybuffer.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_persistence_custom_protocol_handler.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_persistence_event_viewer_events_asp.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_persistence_globalflags.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_persistence_ie.yml

Merge PR #5513 from @swachchhanda000 - fix FPs observed via Aurora

2025-07-08 10:29:01 +02:00

registry_set_persistence_ifilter.yml

Merge PR #5177 from @nasbench - promote older rules status from experimental to test

2025-02-03 18:23:12 +01:00

registry_set_persistence_lsa_extension.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_persistence_mpnotify.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_persistence_mycomputer.yml

Merge PR #5101 from @nasbench - Promote older rules status from experimental to test

2024-12-01 13:40:32 +01:00

registry_set_persistence_natural_language.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_persistence_office_vsto.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_persistence_outlook_homepage.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_persistence_outlook_todaypage.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_persistence_reflectdebugger.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_persistence_scrobj_dll.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_persistence_shim_database_susp_application.yml

Merge PR #5027 from @nasbench - Promote older rules status from experimental to test

2024-10-01 14:56:09 +02:00

registry_set_persistence_shim_database_uncommon_location.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_persistence_shim_database.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_persistence_typed_paths.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_persistence_xll.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_policies_associations_tamper.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_policies_attachments_tamper.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_powershell_as_service.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_powershell_enablescripts_enabled.yml

Merge PR #4991 from @nasbench - Promote older rules status from experimental to test

2024-09-02 10:01:36 +02:00

registry_set_powershell_execution_policy.yml

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

registry_set_powershell_in_run_keys.yml

Merge PR #5534 from @swachchhanda000 - update PowerShell WebRequest rules

2025-07-28 13:32:57 +02:00

registry_set_powershell_logging_disabled.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_provisioning_command_abuse.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_renamed_sysinternals_eula_accepted.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_rpcrt4_etw_tamper.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_runmru_susp_command_execution.yml

Merge PR #5067 from @nasbench - Add missing reference links

2024-11-01 20:52:27 +01:00

registry_set_scr_file_executed_by_rundll32.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_sentinelone_shell_context_tampering.yml

Merge PR #5149 from @nasbench - Promote older rules status from experimental to test

2025-01-06 15:36:19 +01:00

registry_set_servicedll_hijack.yml

Merge PR #5177 from @nasbench - promote older rules status from experimental to test

2025-02-03 18:23:12 +01:00

registry_set_services_etw_tamper.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_set_nopolicies_user.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_sip_persistence.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_sophos_av_tamper.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_special_accounts.yml

Merge PR #4961 from @tsale - Add multiples rules and updates

2024-08-29 19:21:47 +02:00

registry_set_suppress_defender_notifications.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_susp_keyboard_layout_load.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_susp_pendingfilerenameoperations.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_susp_printer_driver.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_susp_reg_persist_explorer_run.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_susp_run_key_img_folder.yml

Merge PR #5196 from @swachchhanda000 - Updated and Added rules related to Autorun Registry

2025-05-12 13:28:51 +02:00

registry_set_susp_service_installed.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_susp_user_shell_folders.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_suspicious_env_variables.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_system_lsa_nolmhash.yml

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

registry_set_taskcache_entry.yml

Merge PR #5513 from @swachchhanda000 - fix FPs observed via Aurora

2025-07-08 10:29:01 +02:00

registry_set_telemetry_persistence.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_terminal_server_suspicious.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_terminal_server_tampering.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_timeproviders_dllname.yml

Merge PR #5177 from @nasbench - promote older rules status from experimental to test

2025-02-03 18:23:12 +01:00

registry_set_tls_protocol_old_version_enabled.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_treatas_persistence.yml

Merge PR #5520 from @swachchhanda000 - Fix Logic in some rules that were causing FPs and FNs

2025-07-14 12:04:39 +02:00

registry_set_turn_on_dev_features.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_uac_bypass_eventvwr.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_uac_bypass_sdclt.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_uac_bypass_winsat.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_uac_bypass_wmp.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_uac_disable_notification.yml

Merge PR #5249 from @nasbench - Promote older rules status from experimental to test

2025-04-17 00:41:35 +02:00

registry_set_uac_disable_secure_desktop_prompt.yml

Merge PR #5249 from @nasbench - Promote older rules status from experimental to test

2025-04-17 00:41:35 +02:00

registry_set_uac_disable.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_vbs_payload_stored.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_wab_dllpath_reg_change.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_wdigest_enable_uselogoncredential.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_windows_defender_tamper.yml

Merge PR #5037 from @MalGamy12 - Update Disable Windows Defender Functionalities Via Registry Keys

2024-10-08 22:07:45 +02:00

registry_set_winget_admin_settings_tampering.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_winget_enable_local_manifest.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_winlogon_allow_multiple_tssessions.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

registry_set_winlogon_notify_key.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00