{"id":"d3abac66-f11c-4ed0-8acb-50cc29c97eed","title":"NetNTLM Downgrade Attack","description":"Detects NetNTLM downgrade attack","author":"Florian Roth (Nextron Systems), wagga","status":"test","level":"high","date":"2018-03-20","modified":"2022-10-09","tags":["attack.persistence","attack.defense-impairment","attack.t1685","attack.t1112"],"technique_ids":["T1112","T1685"],"logsource":{"product":"windows","service":"security","definition":"Requirements: Audit Policy : Object Access > Audit Registry (Success)"},"falsepositives":["Unknown"],"references":["https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks"],"source_path":"rules/windows/builtin/security/win_security_net_ntlm_downgrade.yml","source_sha256":"1b89c65bdbe7cbc4a5aa3a4289e13469bde2fd9c9159af8408fa47751bd5d469","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_net_ntlm_downgrade.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: NetNTLM Downgrade Attack\nid: d3abac66-f11c-4ed0-8acb-50cc29c97eed\nrelated:\n    - id: d67572a0-e2ec-45d6-b8db-c100d14b8ef2\n      type: derived\nstatus: test\ndescription: Detects NetNTLM downgrade attack\nreferences:\n    - https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks\nauthor: Florian Roth (Nextron Systems), wagga\ndate: 2018-03-20\nmodified: 2022-10-09\ntags:\n    - attack.persistence\n    - attack.defense-impairment\n    - attack.t1685\n    - attack.t1112\nlogsource:\n    product: windows\n    service: security\n    definition: 'Requirements: Audit Policy : Object Access > Audit Registry (Success)'\ndetection:\n    selection:\n        EventID: 4657\n        ObjectName|contains|all:\n            - '\\REGISTRY\\MACHINE\\SYSTEM'\n            - 'ControlSet'\n            - '\\Control\\Lsa'\n        ObjectValueName:\n            - 'LmCompatibilityLevel'\n            - 'NtlmMinClientSec'\n            - 'RestrictSendingNTLMTraffic'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"},{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/d3abac66-f11c-4ed0-8acb-50cc29c97eed.json","kind":"sigma"}