EnableLinkedConnections Registry Edit
Last updated on:
In this page
Rule name | Rule type | Log sources | MITRE ATT&CK tags | Severity |
|---|---|---|---|---|
EnableLinkedConnections Registry Edit | Standard | Windows, Sysmon | Persistence: Modify Registry (T1112) | Trouble |
About the rule
Rule Type
Standard
Rule Description
Detects the modification of the EnableLinkedConnections registry value. This configuration allows an administrator-level user to share network connections and mapped drives between their filtered (standard) and elevated tokens, which can be exploited by malware to gain access to network resources.
Why this rule?
While this setting has legitimate administrative uses, adversaries can enable it to access network resources with elevated privileges using mapped drives. This configuration change can facilitate lateral movement and data exfiltration. Monitoring this modification helps identify potential privilege abuse or preparation for network-based attacks.
Severity
Trouble
Rule journey
Attack chain scenario
Initial Access → Privilege Escalation → Registry Modification (EnableLinkedConnections) → Malware accessing administrative network shares using the user's elevated token.
Impact
Increased risk of malware spreading via network shares and unauthorized access to protected network resources from a standard user context.
Rule Requirement
Prerequisites
Enable Registry auditing for the path: HKEY_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\Policies\System.
Criteria
Action1:
actionname = "Registry Event" AND ( OBJECTNAME contains "Windows\CurrentVersion\Policies\System" ) AND ( OBJECTNAME endswith "EnableLinkedConnections" OR OBJECTVALUENAME = "EnableLinkedConnections" ) AND ( CHANGES = "1" OR INFORMATION = "DWORD (0x00000001)" )
select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.OBJECTNAME,Action1.OBJECTVALUENAME,Action1.ACCESSES,Action1.USERNAME,Action1.DOMAIN,Action1.PREVVAL,Action1.CHANGES,Action1.INFORMATION
Detection
Execution Mode
realtime
Log Sources
Windows
MITRE ATT&CK
Persistence: Modify Registry (T1112)
Future actions
Known False Positives
Legitimate configuration by IT administrators to fix issues where mapped drives are not visible in elevated command prompts or applications.
Next Steps
- Identification: Verify if the registry change was pushed via an authorized Group Policy.
- Analysis: Check if the user who made the change has a legitimate need to see mapped drives in elevated sessions.
- Response: Revert the registry value if it does not conform to the organization's security baseline.
Mitigation
ID | Mitigation | Description |
|---|---|---|
Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation. |
