Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback

Title: Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback
Status: test
Description:Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that do not have a trust relationship.
References:
  -https://learn.microsoft.com/en-us/windows/win32/wmisdk/connecting-to-wmi-remotely-starting-with-vista
Author: X__Junior (Nextron Systems)
Date: 2023-11-03
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• product: windows
• category: registry_set

Detection:
  selection:
    TargetObject|contains: '\Microsoft\WBEM\CIMOM\AllowAnonymousCallback'
    Details: 'DWORD (0x00000001)'
  condition:selection
Falsepositives:
  -Administrative activity
Level: medium