Movatterモバイル変換

[0]ホーム
URL:

  1. Home
  2. Mitigations
  3. Restrict Registry Permissions

Restrict Registry Permissions

Restricting registry permissions involves configuring access control settings for sensitive registry keys and hives to ensure that only authorized users or processes can make modifications. By limiting access, organizations can prevent unauthorized changes that adversaries might use for persistence, privilege escalation, or defense evasion. This mitigation can be implemented through the following measures:

Review and Adjust Permissions on Critical Keys

  • Regularly review permissions on keys such asRun,RunOnce, andServices to ensure only authorized users have write access.
  • Use tools likeicacls orPowerShell to automate permission adjustments.

Enable Registry Auditing

  • Enable auditing on sensitive keys to log access attempts.
  • Use Event Viewer or SIEM solutions to analyze logs and detect suspicious activity.
  • Example Audit Policy:auditpol /set /subcategory:"Registry" /success:enable /failure:enable

Protect Credential-Related Hives

  • Limit access to hives likeSAM,SECURITY, andSYSTEM to prevent credential dumping or other unauthorized access.
  • Use LSA Protection to add an additional security layer for credential storage.

Restrict Registry Editor Usage

  • Use Group Policy to restrict access to regedit.exe for non-administrative users.
  • Block execution of registry editing tools on endpoints where they are unnecessary.

Deploy Baseline Configuration Tools

  • Use tools like Microsoft Security Compliance Toolkit or CIS Benchmarks to apply and maintain secure registry configurations.

Tools for Implementation

Registry Permission Tools:

  • Registry Editor (regedit): Built-in tool to manage registry permissions.
  • PowerShell: Automate permissions and manage keys.Set-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "KeyName" -Value "Value"
  • icacls: Command-line tool to modify ACLs.

Monitoring Tools:

  • Sysmon: Monitor and log registry events.
  • Event Viewer: View registry access logs.

Policy Management Tools:

  • Group Policy Management Console (GPMC): Enforce registry permissions via GPOs.
  • Microsoft Endpoint Manager: Deploy configuration baselines for registry permissions.
ID: M1024
Version: 1.2
Created: 06 June 2019
Last Modified: 24 December 2024
Enterprise Layer
downloadview

Techniques Addressed by Mitigation

DomainIDNameUse
EnterpriseT1547.003Boot or Logon Autostart Execution:Time Providers

Consider using Group Policy to configure and block modifications to W32Time parameters in the Registry.[1]

EnterpriseT1037Boot or Logon Initialization Scripts

Ensure proper permissions are set for Registry hives to prevent users from modifying keys for logon scripts that may lead to persistence.

.001Logon Script (Windows)

Ensure proper permissions are set for Registry hives to prevent users from modifying keys for logon scripts that may lead to persistence.

EnterpriseT1574Hijack Execution Flow

Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.

.011Services Registry Permissions Weakness

Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.

.012COR_PROFILER

Ensure proper permissions are set for Registry hives to prevent users from modifying keys associated with COR_PROFILER.

EnterpriseT1562Impair Defenses

Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering with security/logging services.

.001Disable or Modify Tools

Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering with security services.

.002Disable Windows Event Logging

Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering logging. The addition of the MiniNT registry key disables Event Viewer.[2]

.004Disable or Modify System Firewall

Ensure proper Registry permissions are in place to prevent adversaries from disabling or modifying firewall settings.

EnterpriseT1070.007Indicator Removal:Clear Network Connection History and Configurations

Protect generated event files and logs that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.

EnterpriseT1556Modify Authentication Process

Restrict Registry permissions to disallow the modification of sensitive Registry keys such asHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order.

.008Network Provider DLL

Restrict Registry permissions to disallow the modification of sensitive Registry keys such asHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order.

EnterpriseT1112Modify Registry

Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.

EnterpriseT1505Server Software Component

Consider using Group Policy to configure and block modifications to service and other critical server parameters in the Registry.[3]

.005Terminal Services DLL

Consider using Group Policy to configure and block modifications to Terminal Services parameters in the Registry.[3]

EnterpriseT1489Service Stop

Ensure proper registry permissions are in place to inhibit adversaries from disabling or interfering with critical services.

EnterpriseT1553Subvert Trust Controls

Ensure proper permissions are set for Registry hives to prevent users from modifying keys related to SIP and trust provider components. Components may still be able to be hijacked to suitable functions already present on disk if malicious modifications to Registry keys are not prevented.

.003SIP and Trust Provider Hijacking

Ensure proper permissions are set for Registry hives to prevent users from modifying keys related to SIP and trust provider components. Components may still be able to be hijacked to suitable functions already present on disk if malicious modifications to Registry keys are not prevented.

.006Code Signing Policy Modification

Ensure proper permissions are set for the Registry to prevent users from modifying keys related to code signing policies.

References

×
[8]ページ先頭
©2009-2026 Movatter.jp