Potential WHQL Signing Requirements Bypass Via Registry Tampering

Rule Info

Name
Potential WHQL Signing Requirements Bypass Via Registry Tampering
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects when certain registry keys are set to allow the bypass of WHQL signing requirements.
Reference
https://www.geoffchappell.com/notes/security/whqlsettings/index.htm
Date
2024-01-10 00:00:00
Modified
None
Id
6b4114c8-571c-4623-95c2-158bd18cef89
Tags
attack.defense-evasion
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022