Query: detection rule: Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry
Matching passage: Sigma rule: Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry. Logsource: windows / registry_set. Rule: title: Enable LM Hash Storage id: c420410f-c2d8-4010-856b-dffe21866437 related: - id: 98dedfdd-8333-49d4-9f23-d7018cccae53 type: similar status: test description: 'Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases. ' references: - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a - https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password - https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-12-15 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: System\CurrentControlSet\Control\Lsa\NoLMHash Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level.. Logsource: windows / process_creation. Rule: title: PUA - PingCastle Execution id: b1cb4ab6-ac31-43f4-adf1-d9d08957419c related: - id: b37998de-a70b-4f33-b219-ec36bf433dc0 type: derived status: test description: Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level. references: - https://github.com/vletoux/pingcastle - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/ - https://github.com/fengjixuchui/Start-ADEnum/blob/e237a739db98b6104427d833004836507da36a58/Functions/Start-ADEnum.ps1#L450 - https://github.com/lkys37en/Start-ADEnum/blob/5b42c54215fe5f57fc59abc52c20487d15764005/Functions/Start-ADEnum.ps1#L680 - https://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699 - https://github.com/802-1x/Compliance/blob/2e53df8b6e89686a0b91116b3f42c8f717dca820/Ping%20Castle/Get-PingCastle-HTMLComplianceReport.ps1#L8 - https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1 author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2024-01-11 tags: - attack.reconnaissance - attack.t1595 logsource: category: process_creation product: windows detection: selection: - Hashes|contains: - MD5=f741f25ac909ee434e50812d436c73ff - MD5=d40acbfc29ee24388262e3d8be16f622 - MD5=01bb2c16fadb992fa66228cd02d45c60 - MD5=9e1b18e62e42b5444fc55b51e640355b - MD5=b7f8fe33ac471b074ca9e630ba0c7e79 - MD5=324579d717c9b9b8e71d0269d13f811f - MD5=63257a1ddaf83cfa43fe24a3bc06c207 - MD5=049e85963826b059c9bac273bb9c82ab - MD5=ecb98b7b4d4427eb8221381154ff4cb2 - MD5=faf87749ac790ec3a10dd069d10f9d63 - MD5=f296dba5d21ad18e6990b1992aea8f83 - MD5=93ba94355e794b6c6f98204cf39f7a11 - MD5=a258ef593ac63155523a461ecc73bdba - MD5=97000eb5d1653f1140ee3f47186463c4 - MD5=95eb317fbbe14a82bd9fdf31c48b8d93 - MD5=32fe9f0d2630ac40ea29023920f20f49 - MD5=a05930dde939cfd02677fc18bb2b7df5 - MD5=124283924e86933ff9054a549d3a268b - MD5=ceda6909b8573fdeb0351c6920225686 - MD5=60ce120040f2cd311c810ae6f6bbc182 - MD5=2f10cdc5b09100a260703a28eadd0ceb - MD5=011d967028e797a4c16d547f7ba1463f - MD5=2da9152c0970500c697c1c9b4a9e0360 - MD5=b5ba72034b8f44d431f55275bace9f8b - MD5=d6ed9101df0f24e27ff92ddab42dacca - MD5=3ed3cdb6d12aa1ac562ad185cdbf2d1d - MD5=5e083cd0143ae95a6cb79b68c07ca573 - MD5=28caff93748cb84be70486e79f04c2df - MD5=9d4f12c30f9b500f896efd1800e4dd11 - MD5=4586f7dd14271ad65a5fb696b393f4c0 - MD5=86ba9dddbdf49215145b5bcd081d4011 - MD5=9dce0a481343874ef9a36