Query: detect Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry in logs
Matching passage: Sigma rule: Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry. Logsource: windows / process_creation. Rule: title: Enable LM Hash Storage - ProcCreation id: 98dedfdd-8333-49d4-9f23-d7018cccae53 related: - id: c420410f-c2d8-4010-856b-dffe21866437 type: similar status: test description: 'Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases. ' references: - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a - https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password - https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-12-15 modified: 2023-12-22 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: process_creation detection: selection: CommandLine|contains|all: - \System\CurrentControlSet\Control\Lsa - NoLMHash - ' 0' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260. Logsource: windows / process_creation. Rule: title: Suspicious LNK Command-Line Padding with Whitespace Characters id: dd8756e7-a3a0-4768-b47e-8f545d1a751c status: experimental description: 'Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D). Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary. The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks. This rule flags suspicious use of such padding observed in real-world attacks. ' references: - https://syedhasan010.medium.com/forensics-analysis-of-an-lnk-file-da68a98b8415 - https://thehackernews.com/2025/03/unpatched-windows-zero-day-flaw.html - https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-03-19 tags: - attack.initial-access - attack.execution - attack.t1204.002 logsource: category: process_creation product: windows detection: selection_img: - ParentImage|endswith: \explorer.exe - ParentCommandLine|contains: .lnk selection_cmd: - CommandLine|contains: - ' ' - \u0009 - \u000A - \u0011 - \u0012 - \u0013 - \u000B - \u000C - \u000D - CommandLine|re: \n\n\n\n\n\n condition: all of selection_* falsepositives: - Unknown level: high