Hunt - Windows Disable Windows Registry Tool (T1112)

Danny Y@zendannyy

•updated Jul 21, 2026•0•0•0

Hunting rule for Atomic Red Team T1112 test "Disable Windows Registry Tool" (Modify Registry). Correlate with additional signals before alerting.