windows-compliance.conf

{
  "platform": "windows",
  "queries": {
    "command_line_auditing_registry": {
      "query": "SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Audit';",
      "interval": 3600,
      "description": "Controls Windows command-line auditing"
    },
    "crash_dump_registry": {
      "query": "SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\CrashControl\\CrashDumpEnabled';",
      "interval": 3600,
      "description": "Controls enabling/disabling crash dumps. This key has a default value of 7, but some malware sets this value to 0. See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html"
    },
    "dns_plugin_dll_registry": {
      "query": "SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\services\\DNS\\Parameters\\ServerLevelPluginDll';",
      "interval": 3600,
      "description": "This registry key specifies the path to a DLL to be loaded by a Windows DNS server. This key does not exist by default. Can allow privesc: https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83"
    },
    "dr_watson_registry": {
      "query": "SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AeDebug';",
      "interval": 3600,
      "description": "This key (and subkeys) exist by default and are required to allow post-mortem debuggers like Dr. Watson. Some malware deletes this key. See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html"
    },
    "error_display_ui_registry": {
      "query": "SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PCHealth\\ErrorReporting\\ShowUI';",
      "interval": 3600,
      "description": "This key does not exist by default and controls enabling/disabling error reporting display. Some malware creates this key and sets the value to 0. See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html"
    },
    "error_mode_registry": {
      "query": "SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Windows\\ErrorMode';",
      "interval": 3600,
      "description": "Controls the suppression of error dialog boxes. The default value is 0 (all messages are visible), but some malware sets this value to 2 (all messages are invisible). See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html"
    },
    "error_report_registry": {
      "query": "SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PCHealth\\ErrorReporting\\DoReport';",
      "interval": 3600,
      "description": "This key does not exist by default and controls enabling/disabling error reporting. Some malware creates this key sets the value to 0 (disables error reports). See https://msdn.microsoft.com/en-us/library/aa939342(v=winembedded.5).aspx and https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html"
    },
    "event_log_settings_registry": {
      "query": "SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\EventLog\\%%';",
      "interval": 3600,
      "description": "Controls behavior, size, and rotation strategy for primary windows event log files."
    },
    "filerenameoperations_registry": {
      "query": "SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\FileRenameOperations';",
      "interval": 3600,
      "description": "Entries for the FileRenameOperation support the MoveFileEx delayed-rename and delayed-delete capabilities. Sometimes used as a self-deletion technique for malware."
    },
    "knowndlls_registry": {
      "query": "SELECT * FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\KnownDLLs\\%%';",
      "interval": 3600,
      "description": "The KnownDlls key defines the set of DLLs that are first searched during system startup."
    },
    "local_security_authority_registry": {
      "query": "SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\%%';",
      "interval": 3600,
      "description": "Controls which security packages store credentials in LSA memory, secure boot, etc."
    },
    "log_errors_registry": {
      "query": "SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\CrashControl\\LogEvent';",
      "interval": 3600,
      "description": "This key exists by default and has a default value of 1. Setting this key to 0 disables logging errors/crashes to the System event channel. Some malware sets this value to 0. See: https://www.documentcloud.org/documents/3477047-Document-07-Neel-Mehta-Billy-Leonard-and-Shane.html"
    },
    "per_user_ts_session_registry": {
      "query": "SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\fSingleSessionPerUser';",
      "interval": 3600,
      "description": "Controls how many simultaneous terminal services sessions can use the same account"
    },
    "powershell_settings_registry": {
      "query": "SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Powershell\\%%';",
      "interval": 3600,
      "description": "Controls Powershell execution policy, script execution, logging, and more."
    },
    "smbv1_registry": {
      "query": "SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters\\SMB1';",
      "interval": 3600,
      "description": "Controls enabling/disabling SMBv1. Setting this key to 0 disables the SMBv1 protocol on the host."
    },
    "secure_boot_registry": {
      "query": "SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecureBoot';",
      "interval": 3600,
      "description": "Lists information about SecureBoot status."
    },
    "security_providers_registry": {
      "query": "SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\%%';",
      "interval": 3600,
      "description": "Controls Windows security provider configurations"
    },
    "send_error_alert_registry": {
      "query": "SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\CrashControl\\SendAlert';",
      "interval": 3600,
      "description": "Controls sending administrative notifications after a crash. Some malware sets this value to 0"
    },
    "tpm_registry": {
      "query": "SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\TPM';",
      "interval": 3600,
      "description": "Controls system TPM settings"
    },
    "terminal_service_deny_registry": {
      "query": "SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\fDenyTSConnections';",
      "interval": 3600,
      "description": "This key exists by default and has a default value of 1. Terminal service connections are allowed to the host when the key value is set to 0"
    },
    "winrm_settings_registry": {
      "query": "SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WinRM\\%%';",
      "interval": 3600,
      "description": "Controls local WinRM client configuration and security."
    },
    "windows_update_settings_registry": {
      "query": "SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\%%';",
      "interval": 3600,
      "description": "Controls Windows Update server location and installation behavior."
    }
  }
}