Set DisallowRun Registry Value

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects when the 'DisallowRun' registry value is set to '1' under 'Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'. This registry setting prevents users from running specified computer programs, which can be used by adversaries for defense evasion or to restrict user capabilities.