
title: Write Protect For Storage Disabled
author: Sreeman
date: 2021/06/11
description: Looks for changes to registry to disable any write-protect property for
  storage devices. This could be a precursor to a ransomware attack and has been an
  observed technique used by cypherpunk group.
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    CommandLine|re: (?i).*reg add.*hklm\\\\system\\\\currentcontrolset\\\\control.*(storage|storagedevicepolicies).*write
      protection.*0.*
  condition: (SELECTION_1 and SELECTION_2)
falsepositives:
- none observed
id: 75f7a0e2-7154-4c4d-9eae-5cdb4e0a5c13
level: medium
logsource:
  category: process_creation
  product: windows
modified: 2021/06/11
status: experimental
tags:
- attack.defense_evasion
- attack.t1562
ruletype: SIGMA
