LSA PPL Protection Setting Modification via CommandLine

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects modification of LSA PPL protection settings via CommandLine. It may indicate an attempt to disable protection and enable credential dumping tools to access LSASS process memory.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1689` Downgrade Attack

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: LSA PPL Protection Setting Modification via CommandLine
id: 8c0eca51-0f88-4db2-9183-fdfb10c703f9
status: test
description: |
    Detects modification of LSA PPL protection settings via CommandLine.
    It may indicate an attempt to disable protection and enable credential dumping tools to access LSASS process memory.
references:
    - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
    - https://github.com/shoober420/windows11-scripts/blob/38d83331738cd713ccb42f2c4557d17a27aefd98/Windows11Tweaks.bat#L1825
author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2022-03-22
modified: 2026-03-13
tags:
    - attack.defense-impairment
    - attack.t1689
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\reg.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'reg.exe'
              - 'powershell.exe'
              - 'pwsh.dll'
    selection_cli_action:
        CommandLine|contains|all:
            - 'ControlSet'
            - '\Control\Lsa'
        CommandLine|contains:
            - 'Set-ItemProperty'
            - 'New-ItemProperty'
            - ' add '
    selection_key:
        CommandLine|contains:
            - 'IsPplAutoEnabled'
            - 'RunAsPPL'
            - 'RunAsPPLBoot'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith:
          - '\reg.exe'
          - '\powershell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'reg.exe'
          - 'powershell.exe'
          - 'pwsh.dll'

Stage 2: `selection_cli_action`

selection_cli_action:
    CommandLine|contains|all:
        - 'ControlSet'
        - '\Control\Lsa'
    CommandLine|contains:
        - 'Set-ItemProperty'
        - 'New-ItemProperty'
        - ' add '

Stage 3: `selection_key`

selection_key:
    CommandLine|contains:
        - 'IsPplAutoEnabled'
        - 'RunAsPPL'
        - 'RunAsPPLBoot'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`add` corpus 15 (sigma 13, splunk 1, chronicle 1) `ControlSet` corpus 3 (sigma 3) `IsPplAutoEnabled` `New-ItemProperty` corpus 7 (sigma 7) `RunAsPPL` `RunAsPPLBoot` `Set-ItemProperty` corpus 7 (sigma 7) `\Control\Lsa` corpus 2 (sigma 2)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\powershell.exe` corpus 179 (sigma 178, kusto 1) `\pwsh.exe` corpus 165 (sigma 164, kusto 1) `\reg.exe` corpus 58 (sigma 58)	`field:"Image" kind:ends_with`
`OriginalFileName`	eq	`powershell.exe` corpus 138 (sigma 84, splunk 30, elastic 24) `pwsh.dll` corpus 112 (sigma 79, splunk 30, elastic 3) `reg.exe` corpus 43 (sigma 32, splunk 8, elastic 3)	`field:"OriginalFileName" kind:eq`