Windows LSA PPL Protection Setting Modification via reg.exe or PowerShell Command Line
Flags Windows command lines that alter LSA PPL-related Control\Lsa registry settings using reg.exe/PowerShell property changes.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-03-22
- Updated
- 2026-07-30
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies command-line activity that modifies LSA protection-related registry values by targeting Control\Lsa settings such as IsPplAutoEnabled, RunAsPPL, and RunAsPPLBoot. Attackers may use this type of change to weaken protected-process settings to facilitate access to LSASS memory. It relies on process creation telemetry and matches process image names for reg.exe and PowerShell, along with specific command-line patterns indicating registry property updates.
Reporting behind it
- thedfirreport.comhttps://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
- github.comhttps://github.com/shoober420/windows11-scripts/blob/38d83331738cd713ccb42f2c4557d17a27aefd98/Windows11Tweaks.bat#L1825
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lsa_ppl_protection_setting_modification_via_cli.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows LSA PPL Protection Setting Modification via reg.exe or PowerShell Command Line
id: 7389c9dc-8ff2-4dfa-8a71-c3efb42af3a4
status: test
description: This rule identifies command-line activity that modifies LSA protection-related registry values by targeting Control\Lsa settings such as IsPplAutoEnabled, RunAsPPL, and RunAsPPLBoot. Attackers may use this type of change to weaken protected-process settings to facilitate access to LSASS memory. It relies on process creation telemetry and matches process image names for reg.exe and PowerShell, along with specific command-line patterns indicating registry property updates.
references:
- https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
- https://github.com/shoober420/windows11-scripts/blob/38d83331738cd713ccb42f2c4557d17a27aefd98/Windows11Tweaks.bat#L1825
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lsa_ppl_protection_setting_modification_via_cli.yml
author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2022-03-22
modified: 2026-03-13
tags:
- attack.defense-impairment
- attack.t1689
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \reg.exe
- \powershell.exe
- \pwsh.exe
- OriginalFileName:
- reg.exe
- powershell.exe
- pwsh.dll
selection_cli_action:
CommandLine|contains|all:
- ControlSet
- \Control\Lsa
CommandLine|contains:
- Set-ItemProperty
- New-ItemProperty
- " add "
selection_key:
CommandLine|contains:
- IsPplAutoEnabled
- RunAsPPL
- RunAsPPLBoot
condition: all of selection_*
falsepositives:
- Unlikely
level: medium
license: DRL-1.1
related:
- id: 8c0eca51-0f88-4db2-9183-fdfb10c703f9
type: derived