Video Screencast Help
Protect Your POS Environment Against Retail Data Breaches. Learn More.

Creation/deletion/modification of Registry keys as Writable Resource Lists

Created: 14 Feb 2013 | 2 comments
VRSM's picture


Hi there.
Playing around with prevention policies in SCSP v.5.2.9 I've found very weird behavior with registry keys. What I want to see is any creation, deletion or modification in registry keys/subkeys, however I cannot find a common pattern.
Adding the following entry in == Global Policy Options --> Registry Rules --> Writable Resoure Lists --> Allow but log modifications to these Registry Keys==, works as I expect, I see the events for creation, deletion and modification of keys/subkeys.
But doing exactly the same, but different registry key, doesn't behave in the same way. Then I started playing with the "*" and "\" characters, and the results are definitively unexpected.
If I use any of the following entries, the creation and deletion of keys/subkeys are reported, but no modification.
Any other "combination" would result in reporting just the creation or just the deletion of the key/subkey; in the worst case, nothing gets reported.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\USBSTOR\  --> [key creation reported]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\USBSTOR\* --> [key deletion reported]
\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\USBSTOR  --> [nothing reported]
\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\USBSTOR*  --> [nothing reported]
Does anyone see any "predictable" pattern here? Am I missing something?


Comments 2 CommentsJump to latest comment

Alex_CST's picture


\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\USBSTOR  --> [nothing reported]
\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\USBSTOR*  --> [nothing reported]
I can understand why these 2 wouldnt report as they are both incomplete registry locations,  Am I right in saying that if you use USBSTOR\* that key creation DOESN'T get reported, only deletion?  And the same the other way round? for USBSTOR\ ?
Please mark posts as solutions if they solve your problem!

VRSM's picture

Hi Alex_CST. Thanks for your reply.

You're right on saying so. 

USBSTOR\  --> [key creation reported]

USBSTOR\* --> [key deletion reported]
Does that make sense? 
For USBSTOR\*, I've seen two cases, Nothing Reported and Deletion and Creation reported. As I can see, the difference is the "\" in the beggining of the path. 
However what I was originally trying to achieve was to see the creation, MODIFICATION and deletion of keys. So far, I'm unable to find the correct "syntax" to get the MODIFICATION events reported in the console. Any thoughts?