Old TLS 1.0/1.1 Protocol Version Enabled via Registry

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects when an application or user re-enables older, less secure TLS versions (TLS 1.0 or TLS 1.1) by setting the 'Enabled' registry value to '1' under the 'Protocols' key in the Windows registry. This action can weaken the system's security posture by allowing communication over deprecated protocols.