LocalAccountTokenFilterPolicy Registry Value Modified (Sysmon)

id: '40510.73996'
title: LocalAccountTokenFilterPolicy Registry Value Modified
description: The HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy
  key is responsible for controlling how local accounts are filtered when they are
  used to access a Windows system remotely. By setting the key to value '1', it effectively
  disables Remote UAC filtering for local accounts, allowing local admin accounts
  to use elevated tokens (with full admin rights when connecting remotely). This may
  leave a system vulnerable to Pass the Hash attacks. This use case detects registry
  modification events or process executions with registry modification commands targeting
  LocalAccountTokenFilterPolicy.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (((TERM(EventCode=1) OR "<EventID>1<")
  "Set-ItemProperty" OR "sp " OR "ADD") OR (TERM(EventCode=12) OR "<EventID>12<")
  OR TERM(EventCode=13) OR "<EventID>13<") "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
  "LocalAccountTokenFilterPolicy" | table _time, host, user user, process, process_*,
  parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:modify registry
- defense-evasion:use alternate authentication material:pass the hash
technique_id:
- T1112
- T1550.002
data_category:
- Windows Sysmon
references:
- https://www.security.com/threat-intelligence/china-southeast-asia-espionage
- https://posts.specterops.io/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy-506c25a7c167
- https://kb.cybertecsecurity.com/knowledge/localaccounttokenfilterpolicy