Windows Registry: Disable Administrative Share Creation via LanmanServer Parameters

title: "Windows Registry: Disable Administrative Share Creation via LanmanServer Parameters"
id: bb32328c-509b-4b8f-8c28-f91c80b2a135
status: test
description: This rule identifies registry entries under the LanmanServer parameters that set administrative share auto-creation values to DWORD 0x00000000. Attackers may modify these settings to control or reduce exposure from default Windows administrative shares used for remote access. Telemetry relies on registry set events recording the TargetObject path and the written DWORD value.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.005/T1070.005.md#atomic-test-4---disable-administrative-share-creation-at-startup
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_administrative_share.yml
author: frack113, Huntrule Team
date: 2022-01-16
modified: 2024-03-25
tags:
  - attack.stealth
  - attack.t1070.005
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \Services\LanmanServer\Parameters\
    TargetObject|endswith:
      - \AutoShareWks
      - \AutoShareServer
    Details: DWORD (0x00000000)
  condition: selection
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_administrative_share/info.yml
simulation:
  - type: atomic-red-team
    name: Disable Administrative Share Creation at Startup
    technique: T1070.005
    atomic_guid: 99c657aa-ebeb-4179-a665-69288fdd12b8
license: DRL-1.1
related:
  - id: c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e
    type: derived