Skip to content
.ca
Home
Posts
Engagements
Recaps
IOCs
Detections
About
Search posts and IOCs
sign in
Loading…
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnforceUIPI · registry key · cyfar.ca
indicator
registry_key
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnforceUIPI
copy defanged
copy refanged (live)
First seen
2026-05-13
Last seen
2026-05-13
Sightings
1
Posts referencing this indicator
A Deep Dive into the GetProcessHandleFromHwnd API
P
Projectzero
Registry value that, when set to 0, disables UIPI and enables the attack on newer Windows systems.
2026-05-13
