Windows registry artifactHades IOCs
0 = Disabled, 1 = Enabled
- Threat Hunting
- 8 keys
SOFTWARE
Registry keys
8 keys that RECmd reads for this artifact
SOFTWAREUseAdvancedStartupPolicies\Microsoft\Windows\System0 = Disabled, 1 = Enabled
SOFTWAREEnableBDEWithNoTPMPolicies\Microsoft\Windows\System1 = Default, 0 = Disabled, 1 = Enabled
SOFTWAREUseTPMPolicies\Microsoft\Windows\System0 = Do Not Allow TPM, 1 = Require TPM, 2 = Allow TPM
SOFTWAREUseTPMKeyPolicies\Microsoft\Windows\System0 = Do not allow startup key with TPM, 1 = Require startup key with TPM, 2 = Allow startup key with TPM
SOFTWAREUseTPMKeyPINPolicies\Microsoft\Windows\System0 = Do not allow startup key and PIN with TPM, 1 = Require startup key and PIN with TPM, 2 = Allow startup key and PIN with TPM
SOFTWARERecoveryKeyMessagePolicies\Microsoft\Windows\SystemDisplays the Recovery Key message set by the Threat Actor group
SOFTWARERecoveryKeyMessageSourcePolicies\Microsoft\Windows\System2 is set by the Hades group
SOFTWAREUseTPMPINPolicies\Microsoft\Windows\System0 = Do not allow startup PIN with TPM, 1 = Require startup PIN with TPM, 2 = Allow startup PIN with TPM
References
1 link
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)