NetNTLM Downgrade Attack

Severity: high
Author: Florian Roth (Nextron Systems), wagga
Source: upstream

Detects NetNTLM downgrade attack

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1112` Modify Registry
Defense Evasion	`T1112` Modify Registry, `T1562.001` Impair Defenses: Disable or Modify Tools

Event coverage

Provider	Event ID	Title
Security-Auditing	4657	A registry value was modified.

Stages and Predicates

Stage 1: `selection`

ObjectValueName: [LmCompatibilityLevel, NtlmMinClientSec, RestrictSendingNTLMTraffic]
ObjectName|contains: ControlSet
ObjectName|contains: '\Control\Lsa'
ObjectName|contains: '\REGISTRY\MACHINE\SYSTEM'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.