RestrictedAdminMode Registry Value Tampering - ProcCreation
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND COMMANDLINE contains "\System\CurrentControlSet\Control\Lsa" AND COMMANDLINE contains "DisableRestrictedAdmin" select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113
