huntrule

Windows Registry: AllowAnonymousCallback Enabled for Anonymous Remote Connection

Alerts on setting AllowAnonymousCallback to 0x00000001 in the CIMOM key, enabling anonymous remote connections.

FreeUnreviewedSigmamediumv1
title: "Windows Registry: AllowAnonymousCallback Enabled for Anonymous Remote Connection"
id: 4de533a0-1634-41b0-a3ed-31fb3d612696
status: test
description: This rule flags when the registry value "AllowAnonymousCallback" under \Microsoft\WBEM\CIMOM is set to DWORD 0x00000001. Enabling it allows remote connections between computers that do not have a trust relationship, which can broaden remote management exposure. The detection relies on telemetry for registry set events capturing TargetObject and Details.
references:
  - https://learn.microsoft.com/en-us/windows/win32/wmisdk/connecting-to-wmi-remotely-starting-with-vista
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_set_enable_anonymous_connection.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-11-03
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains: \Microsoft\WBEM\CIMOM\AllowAnonymousCallback
    Details: DWORD (0x00000001)
  condition: selection
falsepositives:
  - Administrative activity
level: medium
license: DRL-1.1
related:
  - id: 4d431012-2ab5-4db7-a84e-b29809da2172
    type: derived

What it detects

This rule flags when the registry value "AllowAnonymousCallback" under \Microsoft\WBEM\CIMOM is set to DWORD 0x00000001. Enabling it allows remote connections between computers that do not have a trust relationship, which can broaden remote management exposure. The detection relies on telemetry for registry set events capturing TargetObject and Details.

Known false positives

  • Administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.