Disable Internal Tools or Features via Registry Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•14

Detects registry modifications that disable or change features of internal Windows tools, often used by malware for defense evasion or persistence. This includes disabling command prompt, control panel, run dialog, task manager, user account control (UAC) prompts, write protection, and notification center.