RestrictedAdminMode Registry Value Tampering
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Registry value modified" AND OBJECTNAME endswith "System\CurrentControlSet\Control\Lsa\DisableRestrictedAdmin" OR (OBJECTNAME endswith "System\CurrentControlSet\Control\Lsa" AND OBJECTVALUENAME = "DisableRestrictedAdmin") select Action1.HOSTNAME,Action1.MESSAGE,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.PREVVAL,Action1.CHANGES
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113
