Windows Registry Tampering: DsrmAdminLogonBehavior Value Changes (DSRM)

title: "Windows Registry Tampering: DsrmAdminLogonBehavior Value Changes (DSRM)"
id: 71857aaa-7589-47d0-99f0-0cb7f20854f0
related:
  - id: 53ad8e36-f573-46bf-97e4-15ba5bf4bb51
    type: similar
  - id: b61e87c0-50db-4b2e-8986-6a2be94b33b0
    type: derived
status: test
description: This rule flags registry modifications to the DsrmAdminLogonBehavior value under \Control\Lsa, excluding the default DWORD value of 0x00000000. Changing this setting can alter how the DSRM local administrator account can be used during Domain Controller boot and service states. Attackers may abuse DSRM-related credentials and restore-mode access for persistence or to impair defensive recovery paths. The detection relies on Windows registry set events targeting the specific value path.
references:
  - https://adsecurity.org/?p=1785
  - https://www.sentinelone.com/blog/detecting-dsrm-account-misconfigurations/
  - https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/dsrm-credentials
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_dsrm_tampering.yml
author: Nischal Khadgi, Huntrule Team
date: 2024-07-11
tags:
  - attack.credential-access
  - attack.persistence
  - attack.defense-impairment
  - attack.t1556
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: \Control\Lsa\DsrmAdminLogonBehavior
  filter_main_default_value:
    Details: DWORD (0x00000000)
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1