DSRM password changed (Reg via command)

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.

Known false positives

Disaster recovery situation

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1098` Account Manipulation

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: DSRM password changed (Reg via command)
description: Detects scenarios where an attacker reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1003-Credential%20dumping
- https://adsecurity.org/?p=1714
- https://adsecurity.org/?p=1785
- https://book.hacktricks.xyz/windows/active-directory-methodology/dsrm-credentials
- https://www.hackingarticles.in/domain-persistence-dsrm/
- https://azurecloudai.blog/2020/06/19/how-to-reset-the-directory-service-restore-mode-dsrm-password/
tags:
- attack.persistence
- attack.t1098
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4688
    NewProcessName|endswith: \reg.exe
    CommandLine|contains|all:
      - REG ADD
      - '\SYSTEM\CurrentControlSet\Control\Lsa'
      - DsrmAdminLogonBehavior
  condition: selection
falsepositives:
- Disaster recovery situation
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  EventID: 4688
  NewProcessName|endswith: \reg.exe
  CommandLine|contains|all:
    - REG ADD
    - '\SYSTEM\CurrentControlSet\Control\Lsa'
    - DsrmAdminLogonBehavior

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`DsrmAdminLogonBehavior` `REG ADD` corpus 14 (sigma 13, kusto 1) `\SYSTEM\CurrentControlSet\Control\Lsa` corpus 4 (sigma 4)	`field:"CommandLine" kind:match`
`NewProcessName`	ends_with	`\reg.exe` corpus 58 (sigma 58)	`field:"Image" kind:ends_with value:"\reg.exe"`