NTLM downgrade attack (Reg via SYSMON)

Status: experimental
Severity: high
Log source: category registry_set, product windows
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker modifies the registry configuration in order to enable or downgrade NTLM protocol version, to later on perform relay attacks.

Known false positives

VPN software

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools `T1689` Downgrade Attack

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: NTLM downgrade attack (Reg via SYSMON)
description: Detects scenarios where an attacker modifies the registry configuration in order to enable or downgrade NTLM protocol version, to later on perform relay attacks.
references:
- https://www.trustedsec.com/blog/practical-attacks-against-ntlmv1/
- https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level
- https://www.praetorian.com/blog/ntlmv1-vs-ntlmv2/
tags:
- attack.defense_evasion
- attack.t1562.010 # Impair Defenses: Downgrade Attack 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|endswith: '\SYSTEM\CurrentControlSet\Control\Lsa\LmCompatibilityLevel'
    Details|contains:
      - '0x00000000' # Send LM & NTLM responses
      - '0x00000001' # Send LM & NTLM – use NTLMv2 session security if negotiated
      - '0x00000002' # Send NTLM response only
  condition: selection
falsepositives:
- VPN software
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  TargetObject|endswith: '\SYSTEM\CurrentControlSet\Control\Lsa\LmCompatibilityLevel'
  Details|contains:
    - '0x00000000'
    - '0x00000001'
    - '0x00000002'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Details`	match	`0x00000000` `0x00000001` corpus 4 (sigma 4) `0x00000002`	`field:"Details" kind:match`
`TargetObject`	ends_with	`\SYSTEM\CurrentControlSet\Control\Lsa\LmCompatibilityLevel`	`field:"TargetObject" kind:ends_with value:"\SYSTEM\CurrentControlSet\Control\Lsa\LmCompatibilityLevel"`