{"id":"d67572a0-e2ec-45d6-b8db-c100d14b8ef2","title":"NetNTLM Downgrade Attack - Registry","description":"Detects NetNTLM downgrade attack","author":"Florian Roth (Nextron Systems), wagga, Nasreddine Bencherchali (Splunk STRT)","status":"test","level":"high","date":"2018-03-20","modified":"2024-12-03","tags":["attack.persistence","attack.defense-impairment","attack.t1685","attack.t1112"],"technique_ids":["T1112","T1685"],"logsource":{"product":"windows","category":"registry_event"},"falsepositives":["Services or tools that set the values to more restrictive values"],"references":["https://web.archive.org/web/20171113231705/https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks","https://www.ultimatewindowssecurity.com/wiki/page.aspx?spid=NSrpcservers"],"source_path":"rules/windows/registry/registry_event/registry_event_net_ntlm_downgrade.yml","source_sha256":"d90cf4d9480182a6f575b90a3bd311851497b5b4a245d547a4ed0d953aad6f5d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_net_ntlm_downgrade.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: NetNTLM Downgrade Attack - Registry\nid: d67572a0-e2ec-45d6-b8db-c100d14b8ef2\nstatus: test\ndescription: Detects NetNTLM downgrade attack\nreferences:\n    - https://web.archive.org/web/20171113231705/https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks\n    - https://www.ultimatewindowssecurity.com/wiki/page.aspx?spid=NSrpcservers\nauthor: Florian Roth (Nextron Systems), wagga, Nasreddine Bencherchali (Splunk STRT)\ndate: 2018-03-20\nmodified: 2024-12-03\ntags:\n    - attack.persistence\n    - attack.defense-impairment\n    - attack.t1685\n    - attack.t1112\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection_regkey:\n        TargetObject|contains|all:\n            - 'SYSTEM\\'\n            - 'ControlSet'\n            - '\\Control\\Lsa'\n    selection_value_lmcompatibilitylevel:\n        TargetObject|endswith: '\\lmcompatibilitylevel'\n        Details:\n            - 'DWORD (0x00000000)'\n            - 'DWORD (0x00000001)'\n            - 'DWORD (0x00000002)'\n    selection_value_ntlmminclientsec:\n        TargetObject|endswith: '\\NtlmMinClientSec'\n        Details:\n            - 'DWORD (0x00000000)' # No Security\n            - 'DWORD (0x00000010)' # Only Integrity\n            - 'DWORD (0x00000020)' # Only confidentiality\n            - 'DWORD (0x00000030)' # Both Integrity and confidentiality\n    selection_value_restrictsendingntlmtraffic:\n        # Note: The obvious values with issues are 0x00000000 (allow all) and 0x00000001 (audit).\n        # 0x00000002 can be secure but only if \"ClientAllowedNTLMServers\" is properly configured\n        # Hence all values should be monitored and investigated\n        TargetObject|endswith: '\\RestrictSendingNTLMTraffic'\n    condition: selection_regkey and 1 of selection_value_*\nfalsepositives:\n    - Services or tools that set the values to more restrictive values\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"},{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/d67572a0-e2ec-45d6-b8db-c100d14b8ef2.json","kind":"sigma"}