Windows Process Creation: Enable LM Hash Storage via Lsa\NoLMHash=0 in Command Line

title: "Windows Process Creation: Enable LM Hash Storage via Lsa\\NoLMHash=0 in Command Line"
id: 702e9b82-b936-4da7-9b15-77de3c29c9d2
related:
  - id: c420410f-c2d8-4010-856b-dffe21866437
    type: similar
  - id: 98dedfdd-8333-49d4-9f23-d7018cccae53
    type: derived
status: test
description: This rule matches process creation command lines that reference Lsa\NoLMHash and include a value of 0, indicating an attempt to allow Windows to store LM hashes. Enabling LM hash storage can weaken password protection by permitting LAN Manager hash persistence in Active Directory and local SAM. Telemetry relies on Windows process creation events and the presence of the specified path and value within the command line.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
  - https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password
  - https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_nolmhash.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-12-15
modified: 2023-12-22
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains|all:
      - \System\CurrentControlSet\Control\Lsa
      - NoLMHash
      - " 0"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1