Detection: Windows Disable Shutdown Button Through Registry

Description

The following analytic detects suspicious registry modifications that disable the shutdown button on a user's logon screen. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to registry paths associated with shutdown policies. This activity is significant because it is a tactic used by malware, particularly ransomware like KillDisk, to hinder system usability and prevent the removal of malicious changes. If confirmed malicious, this could impede system recovery efforts, making it difficult to restart the machine and remove other harmful modifications.

Search

 1
 2| tstats `security_content_summariesonly`
 3  count min(_time) as firstTime
 4        max(_time) as lastTime
 5
 6FROM datamodel=Endpoint.Registry WHERE
 7
 8(
 9    (
10    Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\shutdownwithoutlogon"
11    Registry.registry_value_data = "0x00000000"
12    )
13OR
14    (
15        Registry.registry_path="*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoClose"
16        Registry.registry_value_data = "0x00000001"
17    )
18)
19
20by Registry.action Registry.dest Registry.process_guid Registry.process_id
21   Registry.registry_hive Registry.registry_path Registry.registry_key_name
22   Registry.registry_value_data Registry.registry_value_name
23   Registry.registry_value_type Registry.status
24   Registry.user Registry.vendor_product
25
26
27| `drop_dm_object_name(Registry)`
28
29| where isnotnull(registry_value_data)
30
31| `security_content_ctime(firstTime)`
32
33| `security_content_ctime(lastTime)`
34
35| `windows_disable_shutdown_button_through_registry_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 13	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709

Known False Positives

This Windows feature may be implemented by an administrator on some servers where shutdown is restricted. In that scenario, filtering by the machines and users allowed to modify this registry key is recommended.

Associated Analytic Story

• Ransomware

• Windows Registry Abuse

Intermediate Findings

References

• https://github.com/redcanaryco/atomic-red-team/blob/1ba1dd8d9ce6f74700f7aec2e60de5632f667f03/atomics/T1112/T1112.md

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 15