Registry Disable System Restore

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•30

Detects modifications to the Windows Registry that disable the System Restore functionality. This is achieved by setting specific registry values ('DisableConfig' or 'DisableSR') to '1' (DWORD 0x00000001) within the System Restore related registry paths.