Periodic Backup For System Registry Hives Enabled
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the enabling of the "EnablePeriodicBackup" registry value. Once enabled, The OS will backup System registry hives on restarts to the "C:\\Windows\\System32\\config\\RegBack" folder. Windows creates a "RegIdleBackup" task to manage subsequent backups. Registry backup was a default behavior on Windows and was disabled as of "Windows 10, version 1803".
Severity
Trouble
Rule Requirement
Criteria
Action1:
actionname = "Registry value modified" AND (OBJECTNAME endswith "\Control\Session Manager\Configuration Manager\EnablePeriodicBackup" OR (OBJECTNAME endswith "\Control\Session Manager\Configuration Manager" AND OBJECTVALUENAME = "EnablePeriodicBackup")) AND (INFORMATION = "DWORD (0x00000001)" OR (CHANGES = 1 AND NEWTYPE = "REG_DWORD"))
select Action1.HOSTNAME,Action1.MESSAGE,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.PREVVAL,Action1.CHANGES,Action1.USERNAME,Action1.DOMAIN,Action1.NEWTYPE,Action1.OBJECTVALUENAME,Action1.OLDTYPE
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Nasreddine Bencherchali (Nextron Systems)
