RegSubDat

Hunt Hypothesis

This detection rule identifies adversaries attempting to modify registry subkeys and data values, a common tactic used to establish persistence or alter system configurations within an Azure environment. Proactively hunting for these specific registry modifications in Azure Sentinel is critical because low-severity alerts often mask early-stage lateral movement or initial foothold activities that require deeper context analysis before they escalate into significant incidents.

YARA Rule

rule RegSubDat : Family
{
    meta:
        description = "RegSubDat"
        author = "Seth Hardy"
        last_modified = "2014-07-14"
        
    condition:
        RegSubDatCode or RegSubDatStrings
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints
• Source Rule

False Positive Guidance

Here are specific false positive scenarios for the RegSubDat detection rule, focusing on legitimate enterprise activities that modify registry data:

• Endpoint Protection Policy Updates via Group Policy Objects (GPO)

  • Scenario: The System Center Configuration Manager (SCCM) or native Windows Group Policy pushes updated security policies to domain-joined workstations. This process triggers a RegSubDat event as the policy engine writes new registry keys under HKLM\Software\Policies to enforce compliance settings (e.g., disabling USB storage, configuring firewall rules).
  • Filter/Exclusion: Exclude events where the Process Name is gpupdate.exe or GpOpr.exe, and the Registry Key Path contains \Microsoft\Windows NT\CurrentVersion\Group Policy.

• Scheduled Antivirus Definition Synchronization

  • Scenario: Enterprise antivirus solutions like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint run scheduled jobs to update virus definition databases. These agents frequently write version numbers and configuration hashes to the registry (e.g., under HKLM\SOFTWARE\CrowdStrike or HKLM\Software\Microsoft\Windows Defender) during their nightly maintenance window.
  • Filter/Exclusion: Create a rule exclusion for processes running as System or specific service accounts (e.g., svc-crowdstrike, WdNisSvc) where the Registry Key Path matches known vendor paths and the event occurs between 02:00 and 04:00 UTC.

• Software Deployment via Microsoft Intune or SCCM

  • Scenario: During a scheduled application deployment (e.g., updating Adobe Acrobat or Java), the deployment engine modifies registry keys to register new file associations, update license tokens, or configure installation flags. This often generates RegSubDat events on the target