Detection rules › Splunk

Disabling Windows Local Security Authority Defences via Registry

Author
Dean Luxton,Teoderick Contreras Splunk
Source
upstream

The following analytic identifies the deletion of registry keys that disable Local Security Authority (LSA) protection and Microsoft Defender Device Guard. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on registry actions and paths associated with LSA and Device Guard settings. This activity is significant because disabling these defenses can leave a system vulnerable to various attacks, including credential theft and unauthorized code execution. If confirmed malicious, this action could allow attackers to bypass critical security mechanisms, leading to potential system compromise and persistent access.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1556 Modify Authentication Process
Defense EvasionT1556 Modify Authentication Process
Credential AccessT1556 Modify Authentication Process

Event coverage

ProviderEvent IDTitle
Sysmon13RegistryEvent (Value Set)

Stages and Predicates

Stage 1: tstats

tstats WHERE ((Registry.action="modified" Registry.registry_value_data IN (0, 0x00000000)) OR Registry.action="deleted") Registry.registry_path IN ("*\\Lsa\\LsaCfgFlags", "*\\Lsa\\RunAsPPL", "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard\\*") BY Registry.action, Registry.dest, Registry.process_guid, Registry.process_id, Registry.registry_hive, Registry.registry_path, Registry.registry_key_name, Registry.registry_value_data, Registry.registry_value_name, Registry.registry_value_type, Registry.status, Registry.user, Registry.vendor_product

Stage 2: search

search

Stage 3: search

search

Stage 4: search

search

Stage 5: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Registry.actioneq
  • deleted corpus 8 (splunk 8)
  • modified corpus 5 (splunk 5)
Registry.registry_pathin
  • "*\\Lsa\\LsaCfgFlags"
  • "*\\Lsa\\RunAsPPL"
  • "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeviceGuard\\*"
Registry.registry_value_datain
  • 0
  • 0x00000000