Skip to content
Threat Feed

Tag

Windows-Downgrade

1 brief RSS
high advisory

Detect Windows Downdate Registry Activity

This detection identifies registry modifications associated with the Windows Downdate attack, specifically focusing on pending.xml file modifications outside standard locations, which could force a Windows downgrade for exploitation.

Splunk Enterprise +2 windows-downgrade registry-modification defense-evasion persistence
2r 2t