Code Signing Policy Disabled via Registry Modification

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects network traffic (TCP on port 445, typically SMB) containing the strings 'CodeIntegrity' and 'Disabled' (case-insensitive). This pattern suggests an attempt to disable code signing policies, potentially via a registry modification, which is a common defense evasion technique used by malware.