Disable Internal Tools or Feature in Registry
Detects modifications to specific Windows Registry keys that disable or modify features of internal Windows tools. These modifications are often used by malware to hinder system functionality or security mechanisms. The rule looks for changes to registry keys related to disabling the command prompt, control panel, run dialog, log off, password changes, workstation locking, registry tools, task manager, display settings, notification center, UAC consent prompt behavior, inactivity timeout, shutdown without logon, push notifications, and write protection for storage devices. The rule specifically looks for these registry keys being set to a DWORD value of '0x00000001' (to disable features) or '0x00000000' (to enable or modify behavior of certain features like UAC consent prompt, inactivity timeout, shutdown without logon, push notifications, and write protection).
YARA-L
