Windows Process Creation: Enable LM Hash Storage via Lsa\NoLMHash=0 in Command Line
Flags process command lines that set Lsa\NoLMHash to 0 to enable LM hash storage.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-12-15
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches process creation command lines that reference Lsa\NoLMHash and include a value of 0, indicating an attempt to allow Windows to store LM hashes. Enabling LM hash storage can weaken password protection by permitting LAN Manager hash persistence in Active Directory and local SAM. Telemetry relies on Windows process creation events and the presence of the specified path and value within the command line.
Reporting behind it
- cisa.govhttps://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
- learn.microsoft.comhttps://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password
- sans.orghttps://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_nolmhash.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Enable LM Hash Storage via Lsa\\NoLMHash=0 in Command Line"
id: 702e9b82-b936-4da7-9b15-77de3c29c9d2
related:
- id: c420410f-c2d8-4010-856b-dffe21866437
type: similar
- id: 98dedfdd-8333-49d4-9f23-d7018cccae53
type: derived
status: test
description: This rule matches process creation command lines that reference Lsa\NoLMHash and include a value of 0, indicating an attempt to allow Windows to store LM hashes. Enabling LM hash storage can weaken password protection by permitting LAN Manager hash persistence in Active Directory and local SAM. Telemetry relies on Windows process creation events and the presence of the specified path and value within the command line.
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password
- https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_nolmhash.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-12-15
modified: 2023-12-22
tags:
- attack.persistence
- attack.defense-impairment
- attack.t1112
logsource:
product: windows
category: process_creation
detection:
selection:
CommandLine|contains|all:
- \System\CurrentControlSet\Control\Lsa
- NoLMHash
- " 0"
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1