Periodic Backup For System Registry Hives Enabled

Hunt Hypothesis

Detects the enabling of the “EnablePeriodicBackup” registry value. Once enabled, The OS will backup System registry hives on restarts to the “C:\Windows\System32\config\RegBack” folder. Windows create

Detection Rule

Sigma (Original)

title: Periodic Backup For System Registry Hives Enabled
id: 973ef012-8f1a-4c40-93b4-7e659a5cd17f
status: test
description: |
    Detects the enabling of the "EnablePeriodicBackup" registry value. Once enabled, The OS will backup System registry hives on restarts to the "C:\Windows\System32\config\RegBack" folder. Windows creates a "RegIdleBackup" task to manage subsequent backups.
    Registry backup was a default behavior on Windows and was disabled as of "Windows 10, version 1803".
references:
    - https://learn.microsoft.com/en-us/troubleshoot/windows-client/installing-updates-features-roles/system-registry-no-backed-up-regback-folder
author: Nasreddine Bencherchali (Nextron Systems)
date: 2024-07-01
tags:
    - attack.collection
    - attack.t1113
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Control\Session Manager\Configuration Manager\EnablePeriodicBackup'
        Details: 'DWORD (0x00000001)'
    condition: selection
falsepositives:
    - Legitimate need for RegBack feature by administrators.
level: medium

KQL (Azure Sentinel)

imRegistry
| where RegistryKey endswith "\\Control\\Session Manager\\Configuration Manager\\EnablePeriodicBackup" and RegistryValueData =~ "DWORD (0x00000001)"

KQL (Microsoft 365 Defender)

DeviceRegistryEvents
| where RegistryKey endswith "\\Control\\Session Manager\\Configuration Manager\\EnablePeriodicBackup" and RegistryValueData =~ "DWORD (0x00000001)"

Required Data Sources

False Positive Guidance

• Legitimate need for RegBack feature by administrators.

MITRE ATT&CK Context

• Tactic: Collection
• Technique: T1113 — T1113

References

• https://learn.microsoft.com/en-us/troubleshoot/windows-client/installing-updates-features-roles/system-registry-no-backed-up-regback-folder
• SigmaHQ Rule