Old TLS1.0/TLS1.1 Protocol Version Enabled

Hunt Hypothesis

Detects applications or users re-enabling old TLS versions by setting the “Enabled” value to “1” for the “Protocols” registry key.

Detection Rule

Sigma (Original)

title: Old TLS1.0/TLS1.1 Protocol Version Enabled
id: 439957a7-ad86-4a8f-9705-a28131c6821b
status: test
description: Detects applications or users re-enabling old TLS versions by setting the "Enabled" value to "1" for the "Protocols" registry key.
references:
    - https://techcommunity.microsoft.com/t5/windows-it-pro-blog/tls-1-0-and-tls-1-1-soon-to-be-disabled-in-windows/ba-p/3887947
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-09-05
tags:
    - attack.stealth
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains:
            - '\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\'
            - '\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\'
        TargetObject|endswith: '\Enabled'
        Details: 'DWORD (0x00000001)'
    condition: selection
falsepositives:
    - Legitimate enabling of the old tls versions due to incompatibility
level: medium

KQL (Azure Sentinel)

imRegistry
| where (RegistryKey endswith "\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.0*" or RegistryKey endswith "\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.1*") and RegistryKey endswith "\\Enabled" and RegistryValueData =~ "DWORD (0x00000001)"

KQL (Microsoft 365 Defender)

DeviceRegistryEvents
| where (RegistryKey endswith "\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.0*" or RegistryKey endswith "\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.1*") and RegistryKey endswith "\\Enabled" and RegistryValueData =~ "DWORD (0x00000001)"

Required Data Sources

False Positive Guidance

• Legitimate enabling of the old tls versions due to incompatibility

References

• https://techcommunity.microsoft.com/t5/windows-it-pro-blog/tls-1-0-and-tls-1-1-soon-to-be-disabled-in-windows/ba-p/3887947
• SigmaHQ Rule