Windows Registry Abuse to Disable Lock Workstation Feature

Attackers, including ransomware groups, utilize registry modifications to disable the native Windows Lock Workstation feature. By setting the 'DisableLockWorkstation' registry value to '0x00000001' within the 'Policies\System' hive, adversaries prevent legitimate users from locking their sessions. This tactic serves as a defense evasion mechanism, allowing attackers to maintain active sessions, bypass user-interaction hurdles during malicious activity, and ensure their presence remains uninterrupted on the compromised system. This behavior has been documented in association with various malware strains, including ransomware variants and remote access trojans (RATs) such as FatalRAT, which leverage this configuration change to sustain control over target environments.

Attack Chain

1. Attacker gains initial access to the Windows endpoint via phishing, exploit, or credential theft.
2. Attacker executes malicious binary or script with elevated privileges required to modify system-wide policies.
3. Attacker identifies the target registry path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.
4. Attacker writes the key 'DisableLockWorkstation' with a DWORD value of 1 to the identified registry path.
5. The modification takes effect, causing the 'Lock' option to be removed or disabled for the active user session.
6. Attacker continues malicious operations, such as data exfiltration or ransomware encryption, without the risk of the system locking due to inactivity.

Impact

The primary impact of this modification is the subversion of local security controls and the maintenance of an unlocked session. This ensures that attackers can execute further malicious actions without user interruption. While not resulting in direct data theft by itself, it is a precursor to more severe impact activities like ransomware deployment, where persistent access is required to complete encryption cycles across a network.

Recommendation

1. Deploy the provided Sigma rule to monitor for registry modifications targeting the 'DisableLockWorkstation' key.
2. Use endpoint protection platforms to restrict registry modification permissions for non-administrative processes or users.
3. Monitor Sysmon Event ID 13 (Registry Event) for value changes to the specified path and correlate with suspicious parent processes.