detection.wiki

Detection rules › YARA-L

RestrictedAdminMode Registry Value Tampering

Severity
high
Type
Detection
Time window
5m
Match by
hostname
Source
github.com/chronicle/detection-rules

Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode.\nRestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.\nThis prevents your credentials from being harvested during the initial connection process if the remote server has been compromise

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1112 Modify Registry
Defense ImpairmentT1112 Modify Registry

References

Event coverage

ProviderEventTitle
SysmonEvent ID 13RegistryEvent (Value Set)
Security-AuditingEvent ID 4657A registry value was modified.

Rule body yaral

/*
 * Copyright 2025 Google LLC
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     https://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

rule restrictedadminmode_registry_value_tampering {

  meta:
    author = "frack113"
    description = "Detects changes to the \"DisableRestrictedAdmin\" registry value in order to disable or enable RestrictedAdmin mode.\nRestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.\nThis prevents your credentials from being harvested during the initial connection process if the remote server has been compromise"
    reference = "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_lsa_disablerestrictedadmin.yml"
    license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
    rule_name = "RestrictedAdminMode Registry Value Tampering"
    rule_id = "mr_c996dba7-ebc0-4472-849c-d6ddebffa601"
    sigma_uuid = "d6ce7ebd-260b-4323-9768-a9631c8d4db2"
    sigma_status = "test"
    tactic = "TA0005"
    technique = "T1112"
    type = "Detection"
    data_source = "Sysmon Windows Registry"
    platform = "Windows"
    severity = "High"
    priority = "High"
    false_positives = "Unknown"

  events:
    $reg.metadata.event_type = "REGISTRY_MODIFICATION"
    re.regex($reg.target.registry.registry_key, `System\\CurrentControlSet\\Control\\Lsa\\DisableRestrictedAdmin$`) nocase

    $reg.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
    //example usage of specifying test user and hostname to adjust risk score
    $risk_score = max(if($reg.principal.user.userid = "user" and $reg.principal.hostname = "hostname", 0, 15))
    $principal_hostname = array_distinct($reg.principal.hostname)
    $principal_process_pid = array_distinct($reg.principal.process.pid)
    $principal_process_file_full_path = array_distinct($reg.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($reg.principal.process.product_specific_process_id)
    $principal_user_userid = array_distinct($reg.principal.user.userid)
    $target_registry_key = array_distinct($reg.target.registry.registry_key)
    $target_registry_value_data = array_distinct($reg.target.registry.registry_value_data)
    $log_type = array_distinct(strings.concat($reg.metadata.log_type,"/",$reg.metadata.product_event_type))

  condition:
    $reg
}

Stages and Predicates

Stage 0: match + condition

match:
    $hostname over 5m
condition:
    $reg

Fires when at least one $reg event in the 5m window.

Stage 1: events: $reg · REGISTRY_MODIFICATION

$reg.metadata.event_type = "REGISTRY_MODIFICATION"
re.regex($reg.target.registry.registry_key, `System\\CurrentControlSet\\Control\\Lsa\\DisableRestrictedAdmin$`) nocase

$reg.principal.hostname = $hostname

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
target.registry.registry_keyregex_match
  • System\CurrentControlSet\Control\Lsa\DisableRestrictedAdmin$ transforms: nocase

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
risk_scoremax(if($reg.principal.user.userid = "user" and $reg.principal.hostname = "hostname", 0, 15))
principal_hostnamearray_distinct($reg.principal.hostname)
principal_process_pidarray_distinct($reg.principal.process.pid)
principal_process_file_full_patharray_distinct($reg.principal.process.file.full_path)
principal_process_product_specific_process_idarray_distinct($reg.principal.process.product_specific_process_id)
principal_user_useridarray_distinct($reg.principal.user.userid)
target_registry_keyarray_distinct($reg.target.registry.registry_key)
target_registry_value_dataarray_distinct($reg.target.registry.registry_value_data)
log_typearray_distinct(strings.concat($reg.metadata.log_type,"/",$reg.metadata.product_event_type))