Windows Registry: MaxMpxCt Value Changed (LanmanServer Parameters)

title: "Windows Registry: MaxMpxCt Value Changed (LanmanServer Parameters)"
id: 30deafb7-efb5-4e21-a141-e9cd83f7daa9
status: test
description: This rule flags changes to the MaxMpxCt registry value under \Services\LanmanServer\Parameters. MaxMpxCt controls the maximum outstanding network requests used during SMB session negotiation, so altering it can affect how the server handles client traffic. The detection relies on Windows registry set events that include the specific TargetObject path ending in \Services\LanmanServer\Parameters\MaxMpxCt.
references:
  - https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps
  - https://securityscorecard.com/research/deep-dive-into-alphv-blackcat-ransomware
  - https://www.intrinsec.com/alphv-ransomware-gang-analysis/?cn-reloaded=1
  - https://www.sentinelone.com/labs/blackcat-ransomware-highly-configurable-rust-driven-raas-on-the-prowl-for-victims/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_optimize_file_sharing_network.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-03-19
tags:
  - attack.stealth
  - attack.t1070.005
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: \Services\LanmanServer\Parameters\MaxMpxCt
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 0e6a9e62-627e-496c-aef5-bfa39da29b5e
    type: derived