Windows LSA PPL Protection Setting Modification via reg.exe or PowerShell Command Line

title: Windows LSA PPL Protection Setting Modification via reg.exe or PowerShell Command Line
id: 7389c9dc-8ff2-4dfa-8a71-c3efb42af3a4
status: test
description: This rule identifies command-line activity that modifies LSA protection-related registry values by targeting Control\Lsa settings such as IsPplAutoEnabled, RunAsPPL, and RunAsPPLBoot. Attackers may use this type of change to weaken protected-process settings to facilitate access to LSASS memory. It relies on process creation telemetry and matches process image names for reg.exe and PowerShell, along with specific command-line patterns indicating registry property updates.
references:
  - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
  - https://github.com/shoober420/windows11-scripts/blob/38d83331738cd713ccb42f2c4557d17a27aefd98/Windows11Tweaks.bat#L1825
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lsa_ppl_protection_setting_modification_via_cli.yml
author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2022-03-22
modified: 2026-03-13
tags:
  - attack.defense-impairment
  - attack.t1689
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \reg.exe
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - reg.exe
        - powershell.exe
        - pwsh.dll
  selection_cli_action:
    CommandLine|contains|all:
      - ControlSet
      - \Control\Lsa
    CommandLine|contains:
      - Set-ItemProperty
      - New-ItemProperty
      - " add "
  selection_key:
    CommandLine|contains:
      - IsPplAutoEnabled
      - RunAsPPL
      - RunAsPPLBoot
  condition: all of selection_*
falsepositives:
  - Unlikely
level: medium
license: DRL-1.1
related:
  - id: 8c0eca51-0f88-4db2-9183-fdfb10c703f9
    type: derived