Modification of DisallowRun Registry Policy

The DisallowRun registry key is a Windows policy mechanism that allows administrators to explicitly prevent specific executable files from running. When a user or process sets the 'DisallowRun' value to 1 under 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer', the operating system will block the execution of any files defined in the corresponding 'DisallowRun' subkey. While intended for administrative control, threat actors may use this technique to impair security tools, disable EDR agents, or block analysis utilities from launching on a compromised host. Monitoring these registry modifications is essential for detecting unauthorized defense impairment and persistence-related hardening of a compromised system.

Attack Chain

1. Attacker gains initial access to the target host via phishing or exploited service.
2. Attacker establishes command execution capability via a shell or script.
3. Attacker identifies security software binaries or administrative tools to block.
4. Attacker modifies the registry path 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun' to enable the policy.
5. Attacker populates the 'DisallowRun' subkey with names of targeted binaries (e.g., 'processhacker.exe', 'wireshark.exe').
6. The target application fails to launch, receiving a system access denied error when the user or actor attempts to run the binary.
7. The objective is achieved through the successful impairment of security visibility or response capabilities.

Impact

Successful abuse of the DisallowRun policy results in the forced termination or prevention of legitimate security software. This impact disrupts incident response efforts, prevents the execution of anti-malware scanners, and limits the ability of security teams to monitor attacker activity on the affected endpoint.

Recommendation

• Deploy the Sigma rule below to detect modifications to the DisallowRun policy key.
• Enable Windows Registry auditing (SACL) for 'Set Value' operations on 'HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'.
• Investigate any processes modifying this key that are not associated with managed software deployment or authorized administrative tasks.