DFIRHub

Windows registry artifactWindows SmartScreen

Windows SmartScreen Status, 0 = Disabled (SmartScreen Off), 1 = Enabled

  • Threat Hunting
  • 18 keys
  • SOFTWARENTUSER

Registry keys

18 keys that RECmd reads for this artifact

  • SOFTWAREEnableSmartScreen
    Policies\Microsoft\Windows\System

    Windows SmartScreen Status, 0 = Disabled (SmartScreen Off), 1 = Enabled

  • SOFTWAREShellSmartScreenLevel
    Policies\Microsoft\Windows\System

    Windows SmartScreen Level, Block = Warn and prevent bypass, Warn = Warn and allow bypass

  • SOFTWARESmartScreenEnabled
    Microsoft\Windows\CurrentVersion\Explorer

    Windows SmartScreen for Apps and Files Status, Off = Disabled (SmartScreen Off), Warn = Enabled

  • SOFTWAREConfigureAppInstallControlEnabled
    Policies\Microsoft\Windows Defender\SmartScreen

    Windows SmartScreen Choose Where Apps Are Installed Status - Restricts app installations to Microsoft Store based on setting, 0 = Disabled (AppInstallControl Off), 1 = Enabled

  • SOFTWAREConfigureAppInstallControl
    Policies\Microsoft\Windows Defender\SmartScreen

    Windows SmartScreen Choose Where Apps Are Installed Status - Restricts app installations to Microsoft Store based on setting, Anywhere = Allow all apps to be installed, Recommendations = Allow all apps to be installed but recommend if there is an app in the Microsoft Store, PreferStore = Warn User before installing app that is not from Microsoft Store, StoreOnly = Only allow apps to be installed from Microsoft Store

  • SOFTWAREAicEnabled
    Microsoft\Windows\CurrentVersion\Explorer

    Windows SmartScreen Choose Where Apps Are Installed Status - Restricts app installations to Microsoft Store based on setting, Anywhere = Allow all apps to be installed, Recommendations = Allow all apps to be installed but recommend if there is an app in the Microsoft Store, PreferStore = Warn User before installing app that is not from Microsoft Store, StoreOnly = Only allow apps to be installed from Microsoft Store

  • SOFTWAREEnabledV8
    Policies\Microsoft\Internet Explorer\PhishingFilter

    Windows SmartScreen for Microsoft Internet Explorer 8 Status, 0 = Disabled (SmartScreen Off), 1 = Enabled

  • NTUSEREnabledV8
    software\Microsoft\Internet Explorer\PhishingFilter

    Windows SmartScreen for Microsoft Internet Explorer 8 Status, 0 = Disabled (SmartScreen Off), 1 = Enabled

  • SOFTWAREEnabledV9
    Policies\Microsoft\Internet Explorer\PhishingFilter

    Windows SmartScreen for Microsoft Internet Explorer 9, 10 and 11 Status, 0 = Disabled (SmartScreen Off), 1 = Enabled

  • NTUSEREnabledV9
    software\Microsoft\Internet Explorer\PhishingFilter

    Windows SmartScreen for Microsoft Internet Explorer 9, 10 and 11 Status, 0 = Disabled (SmartScreen Off), 1 = Enabled

  • SOFTWAREEnabledV9
    Policies\Microsoft\MicrosoftEdge\PhishingFilter

    Windows SmartScreen for Microsoft Edge UWP (Non-Chromium) Status, 0 = Disabled (SmartScreen Off), 1 = Block or Warn

  • NTUSEREnabledV9
    software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter

    Windows SmartScreen for Microsoft Edge UWP (Non-Chromium) Status, 0 = Disabled (SmartScreen Off), 1 = Block or Warn

  • SOFTWAREPreventOverride
    Policies\Microsoft\MicrosoftEdge\PhishingFilter

    Windows SmartScreen for Microsoft Edge UWP (Non-Chromium) PreventOverride Status, 0 = Disabled (Off or Warn), 1 = Block

  • NTUSERPreventOverride
    software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter

    Windows SmartScreen for Microsoft Edge UWP (Non-Chromium) PreventOverride Status, 0 = Disabled (Off or Warn), 1 = Block

  • SOFTWARESmartScreenEnabled
    Policies\Microsoft\Edge

    Windows SmartScreen for Microsoft Edge Status, 0 = Disabled (SmartScreen Off), 1 = Enabled

  • NTUSER(default)
    software\Microsoft\Edge\SmartScreenEnabled

    Windows SmartScreen for Microsoft Edge Status, 0 = Disabled (SmartScreen Off), 1 = Enabled

  • SOFTWARESmartScreenPuaEnabled
    Policies\Microsoft\Edge

    Windows SmartScreen for Microsoft Edge Block PUA Downloads Status, 0 = Disabled (SmartScreen Off), 1 = Enabled

  • NTUSER(default)
    software\Microsoft\Edge\SmartScreenPuaEnabled

    Windows SmartScreen for Microsoft Edge Block PUA Downloads Status, 0 = Disabled (SmartScreen Off), 1 = Enabled

References

1 link

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)