Windows Registry: Disable Administrative Share Creation via LanmanServer Parameters
Flags registry writes that disable Windows administrative share auto-creation under LanmanServer parameters.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-16
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies registry entries under the LanmanServer parameters that set administrative share auto-creation values to DWORD 0x00000000. Attackers may modify these settings to control or reduce exposure from default Windows administrative shares used for remote access. Telemetry relies on registry set events recording the TargetObject path and the written DWORD value.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.005/T1070.005.md#atomic-test-4---disable-administrative-share-creation-at-startup
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_administrative_share.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Disable Administrative Share Creation via LanmanServer Parameters"
id: bb32328c-509b-4b8f-8c28-f91c80b2a135
status: test
description: This rule identifies registry entries under the LanmanServer parameters that set administrative share auto-creation values to DWORD 0x00000000. Attackers may modify these settings to control or reduce exposure from default Windows administrative shares used for remote access. Telemetry relies on registry set events recording the TargetObject path and the written DWORD value.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.005/T1070.005.md#atomic-test-4---disable-administrative-share-creation-at-startup
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_disable_administrative_share.yml
author: frack113, Huntrule Team
date: 2022-01-16
modified: 2024-03-25
tags:
- attack.stealth
- attack.t1070.005
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \Services\LanmanServer\Parameters\
TargetObject|endswith:
- \AutoShareWks
- \AutoShareServer
Details: DWORD (0x00000000)
condition: selection
falsepositives:
- Unknown
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_administrative_share/info.yml
simulation:
- type: atomic-red-team
name: Disable Administrative Share Creation at Startup
technique: T1070.005
atomic_guid: 99c657aa-ebeb-4179-a665-69288fdd12b8
license: DRL-1.1
related:
- id: c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e
type: derived