NetNTLM Downgrade Attack - Registry

Title: NetNTLM Downgrade Attack - Registry
Status: test
Description:Detects NetNTLM downgrade attack
References:
  -https://web.archive.org/web/20171113231705/https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks
  -https://www.ultimatewindowssecurity.com/wiki/page.aspx?spid=NSrpcservers
Author: Florian Roth (Nextron Systems), wagga, Nasreddine Bencherchali (Splunk STRT)
Date: 2018-03-20
modified:2024-12-03
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1685'
• -'attack.t1112'

Logsource:

• product: windows
• category: registry_event

Detection:
  selection_regkey:
    TargetObject|contains|all:
      -'SYSTEM\'
      -'ControlSet'
      -'\Control\Lsa'

  selection_value_lmcompatibilitylevel:
    TargetObject|endswith: '\lmcompatibilitylevel'
    Details:
      -'DWORD (0x00000000)'
      -'DWORD (0x00000001)'
      -'DWORD (0x00000002)'

  selection_value_ntlmminclientsec:
    TargetObject|endswith: '\NtlmMinClientSec'
    Details:
      -'DWORD (0x00000000)'
      -'DWORD (0x00000010)'
      -'DWORD (0x00000020)'
      -'DWORD (0x00000030)'

  selection_value_restrictsendingntlmtraffic:
    TargetObject|endswith: '\RestrictSendingNTLMTraffic'
  condition:selection_regkey and 1 of selection_value_*
Falsepositives:
  -Services or tools that set the values to more restrictive values
Level: high