MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1112Modify Registry

Defense ImpairmentPersistence

View on MITRE ATT&CK →

1 Query

Defense Evasion via Registry Modification of Security Settings

mediumproductionDefender XDR

Microsoft Defender for Endpoint·DeviceRegistryEvents

DeviceRegistryEvents
| where Timestamp > ago(1d)
| where ActionType == "RegistryValueSet"
| where (
    (RegistryKey has "EnableFirewall" and RegistryValueData == "0")
    or (RegistryKey has "DisableAntiSpyware" and RegistryValueData == "1")
    or (RegistryKey has "AmsiEnable" and RegistryValueData == "0")
    or (RegistryKey has "EnableScriptBlockLogging" and RegistryValueData == "0")
    or (RegistryKey has "EnableLUA" and RegistryValueData == "0")
    or (RegistryKey has "ConsentPromptBehaviorAdmin" and RegistryValueData == "0")
)
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessAccountName
| sort by Timestamp desc

Microsoft (adapted) · last tested 2025-03-01

Tuning notes

GPO deployments may set these registry values. Correlate with change management — registry changes outside GPO refresh cycles warrant investigation.

+ Add another query for this technique →