The current detection alerts when the shutdownwithoutlogon registry key is set to 0x00000000. However, setting this to 0 is the default Windows Server behavior and a strict CIS Benchmark requirement:
(2.3.13.1 (L1) Ensure 'Shutdown: Allow system to be shut down without having to log on' is set to 'Disabled' (Automated))
to prevent unauthenticated lock-screen shutdowns.
The Trend Micro malware reference in the description was likely misinterpreted. The article lists setting the value to 0 as the remediation/restore step to fix the machine, not the malicious state.
I suggest changing the shutdownwithoutlogon condition to monitor for the 0x00000001 value. This will correctly catch the malware behavior noted by Trend Micro, while also alerting on servers that are violating CIS best practices.
Thanks!
The current detection alerts when the shutdownwithoutlogon registry key is set to 0x00000000. However, setting this to 0 is the default Windows Server behavior and a strict CIS Benchmark requirement:
(2.3.13.1 (L1) Ensure 'Shutdown: Allow system to be shut down without having to log on' is set to 'Disabled' (Automated))
to prevent unauthenticated lock-screen shutdowns.
The Trend Micro malware reference in the description was likely misinterpreted. The article lists setting the value to 0 as the remediation/restore step to fix the machine, not the malicious state.
I suggest changing the shutdownwithoutlogon condition to monitor for the 0x00000001 value. This will correctly catch the malware behavior noted by Trend Micro, while also alerting on servers that are violating CIS best practices.
Thanks!