Windows Registry: Set LSA NoLMHash to 0 to Enable LM Hash Storage

title: "Windows Registry: Set LSA NoLMHash to 0 to Enable LM Hash Storage"
id: e6e26896-9a8d-4df0-929e-7f5ff83bc90b
related:
  - id: 98dedfdd-8333-49d4-9f23-d7018cccae53
    type: similar
  - id: c420410f-c2d8-4010-856b-dffe21866437
    type: derived
status: test
description: This rule alerts when the LSA registry setting "NoLMHash" is changed to DWORD 0, which allows Windows to store LAN Manager (LM) password hashes in Active Directory and local SAM databases. Enabling LM hash storage can weaken password hash protections and increase the exposure of credentials if those hashes are later accessed. It relies on Windows registry set telemetry capturing the modified value path and the specific DWORD data of 0.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
  - https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password
  - https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_system_lsa_nolmhash.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-12-15
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|endswith: System\CurrentControlSet\Control\Lsa\NoLMHash
    Details: DWORD (0x00000000)
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1