Windows Registry Tampering: DsrmAdminLogonBehavior Value Changes (DSRM)
Alerts when DsrmAdminLogonBehavior registry value is changed on Windows, except the default DWORD 0x00000000.
- Product
- windows
- Category
- registry_set
- Author
- Nischal Khadgi (SigmaHQ), DRL 1.1
- Published
- 2024-07-11
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry modifications to the DsrmAdminLogonBehavior value under \Control\Lsa, excluding the default DWORD value of 0x00000000. Changing this setting can alter how the DSRM local administrator account can be used during Domain Controller boot and service states. Attackers may abuse DSRM-related credentials and restore-mode access for persistence or to impair defensive recovery paths. The detection relies on Windows registry set events targeting the specific value path.
Reporting behind it
- adsecurity.orghttps://adsecurity.org/?p=1785
- sentinelone.comhttps://www.sentinelone.com/blog/detecting-dsrm-account-misconfigurations/
- book.hacktricks.xyzhttps://book.hacktricks.xyz/windows-hardening/active-directory-methodology/dsrm-credentials
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_dsrm_tampering.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry Tampering: DsrmAdminLogonBehavior Value Changes (DSRM)"
id: 71857aaa-7589-47d0-99f0-0cb7f20854f0
related:
- id: 53ad8e36-f573-46bf-97e4-15ba5bf4bb51
type: similar
- id: b61e87c0-50db-4b2e-8986-6a2be94b33b0
type: derived
status: test
description: This rule flags registry modifications to the DsrmAdminLogonBehavior value under \Control\Lsa, excluding the default DWORD value of 0x00000000. Changing this setting can alter how the DSRM local administrator account can be used during Domain Controller boot and service states. Attackers may abuse DSRM-related credentials and restore-mode access for persistence or to impair defensive recovery paths. The detection relies on Windows registry set events targeting the specific value path.
references:
- https://adsecurity.org/?p=1785
- https://www.sentinelone.com/blog/detecting-dsrm-account-misconfigurations/
- https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/dsrm-credentials
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_dsrm_tampering.yml
author: Nischal Khadgi, Huntrule Team
date: 2024-07-11
tags:
- attack.credential-access
- attack.persistence
- attack.defense-impairment
- attack.t1556
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|endswith: \Control\Lsa\DsrmAdminLogonBehavior
filter_main_default_value:
Details: DWORD (0x00000000)
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1