Windows Registry: MaxMpxCt Value Changed (LanmanServer Parameters)
Monitors Windows registry updates to MaxMpxCt under LanmanServer parameters, impacting SMB connection request handling.
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-03-19
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags changes to the MaxMpxCt registry value under \Services\LanmanServer\Parameters. MaxMpxCt controls the maximum outstanding network requests used during SMB session negotiation, so altering it can affect how the server handles client traffic. The detection relies on Windows registry set events that include the specific TargetObject path ending in \Services\LanmanServer\Parameters\MaxMpxCt.
Reporting behind it
- huntress.comhttps://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps
- securityscorecard.comhttps://securityscorecard.com/research/deep-dive-into-alphv-blackcat-ransomware
- intrinsec.comhttps://www.intrinsec.com/alphv-ransomware-gang-analysis/?cn-reloaded=1
- sentinelone.comhttps://www.sentinelone.com/labs/blackcat-ransomware-highly-configurable-rust-driven-raas-on-the-prowl-for-victims/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_optimize_file_sharing_network.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: MaxMpxCt Value Changed (LanmanServer Parameters)"
id: 30deafb7-efb5-4e21-a141-e9cd83f7daa9
status: test
description: This rule flags changes to the MaxMpxCt registry value under \Services\LanmanServer\Parameters. MaxMpxCt controls the maximum outstanding network requests used during SMB session negotiation, so altering it can affect how the server handles client traffic. The detection relies on Windows registry set events that include the specific TargetObject path ending in \Services\LanmanServer\Parameters\MaxMpxCt.
references:
- https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps
- https://securityscorecard.com/research/deep-dive-into-alphv-blackcat-ransomware
- https://www.intrinsec.com/alphv-ransomware-gang-analysis/?cn-reloaded=1
- https://www.sentinelone.com/labs/blackcat-ransomware-highly-configurable-rust-driven-raas-on-the-prowl-for-victims/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_optimize_file_sharing_network.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-03-19
tags:
- attack.stealth
- attack.t1070.005
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|endswith: \Services\LanmanServer\Parameters\MaxMpxCt
condition: selection
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: 0e6a9e62-627e-496c-aef5-bfa39da29b5e
type: derived