NetNTLM Downgrade Attack

Title: NetNTLM Downgrade Attack
Status: test
Description:Detects NetNTLM downgrade attack
References:
  -https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks
Author: Florian Roth (Nextron Systems), wagga
Date: 2018-03-20
modified:2022-10-09
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1685'
• -'attack.t1112'

Logsource:

• product: windows
• service: security
• definition: Requirements: Audit Policy : Object Access > Audit Registry (Success)

Detection:
  selection:
    EventID: '4657'
    ObjectName|contains|all:
      -'\REGISTRY\MACHINE\SYSTEM'
      -'ControlSet'
      -'\Control\Lsa'

    ObjectValueName:
      -'LmCompatibilityLevel'
      -'NtlmMinClientSec'
      -'RestrictSendingNTLMTraffic'

  condition:selection
Falsepositives:
  -Unknown
Level: high