Scripted Diagnostics Turn Off Check Enabled - Registry
Detects the modification of the 'TurnOffCheck' registry value to '1' (0x00000001) within the 'ScriptedDiagnostics' key. This action can be used to bypass defenses related to the Microsoft Support Diagnostic Tool (MSDT) Follina vulnerability, as setting this value to 1 disables checks for scripted diagnostics. An attacker might enable this to execute malicious code via MSDT without user interaction or security warnings.
Sigma
