{"id":"8c0eca51-0f88-4db2-9183-fdfb10c703f9","title":"LSA PPL Protection Setting Modification via CommandLine","description":"Detects modification of LSA PPL protection settings via CommandLine.\nIt may indicate an attempt to disable protection and enable credential dumping tools to access LSASS process memory.\n","author":"Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"medium","date":"2022-03-22","modified":"2026-03-13","tags":["attack.defense-impairment","attack.t1689"],"technique_ids":["T1689"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/","https://github.com/shoober420/windows11-scripts/blob/38d83331738cd713ccb42f2c4557d17a27aefd98/Windows11Tweaks.bat#L1825"],"source_path":"rules/windows/process_creation/proc_creation_win_lsa_ppl_protection_setting_modification_via_cli.yml","source_sha256":"fb8b2d4160202698683fded3d521cd2378d58a8fee84b3303b1644d59773df4d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lsa_ppl_protection_setting_modification_via_cli.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: LSA PPL Protection Setting Modification via CommandLine\nid: 8c0eca51-0f88-4db2-9183-fdfb10c703f9\nstatus: test\ndescription: |\n    Detects modification of LSA PPL protection settings via CommandLine.\n    It may indicate an attempt to disable protection and enable credential dumping tools to access LSASS process memory.\nreferences:\n    - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/\n    - https://github.com/shoober420/windows11-scripts/blob/38d83331738cd713ccb42f2c4557d17a27aefd98/Windows11Tweaks.bat#L1825\nauthor: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2022-03-22\nmodified: 2026-03-13\ntags:\n    - attack.defense-impairment\n    - attack.t1689\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '\\reg.exe'\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n        - OriginalFileName:\n              - 'reg.exe'\n              - 'powershell.exe'\n              - 'pwsh.dll'\n    selection_cli_action:\n        CommandLine|contains|all:\n            - 'ControlSet'\n            - '\\Control\\Lsa'\n        CommandLine|contains:\n            - 'Set-ItemProperty'\n            - 'New-ItemProperty'\n            - ' add '\n    selection_key:\n        CommandLine|contains:\n            - 'IsPplAutoEnabled'\n            - 'RunAsPPL'\n            - 'RunAsPPLBoot'\n    condition: all of selection_*\nfalsepositives:\n    - Unlikely\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1689","id":"T1689","name":"Downgrade Attack","page":"techniques/enterprise/T1689/"}],"data_path":"data/detection-rules/8c0eca51-0f88-4db2-9183-fdfb10c703f9.json","kind":"sigma"}