Windows Security: Registry NetNTLM CompatibilityLevel and NTLM Security Downgrade Indicators

Alerts on Windows registry changes that weaken NetNTLM/NTLM security settings via LSA compatibility and restriction values.

FreeUnreviewedSigmahighv1

windows-security-registry-netntlm-compatibilitylevel-and-ntlm-security-downgrade-d3abac66

title: "Windows Security: Registry NetNTLM CompatibilityLevel and NTLM Security Downgrade Indicators"
id: a31c282d-da1f-4105-9983-0ee7a089fd87
related:
  - id: d67572a0-e2ec-45d6-b8db-c100d14b8ef2
    type: derived
  - id: d3abac66-f11c-4ed0-8acb-50cc29c97eed
    type: derived
status: test
description: This rule flags Windows Security Event ID 4657 registry modifications affecting LSA NetNTLM compatibility and NTLM security settings. Specifically, it matches changes to values under HKLM\SYSTEM\ControlSet\Control\Lsa that control LM compatibility, minimum client security, and whether NTLM traffic can be restricted. Attackers may alter these parameters to force weaker NTLM negotiation and compatibility, reducing security and enabling follow-on access or credential abuse. Telemetry relies on the Security log’s registry object change events that include the affected registry path and value names.
references:
  - https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_net_ntlm_downgrade.yml
author: Florian Roth (Nextron Systems), wagga, Huntrule Team
date: 2018-03-20
modified: 2022-10-09
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1685
  - attack.t1112
logsource:
  product: windows
  service: security
  definition: "Requirements: Audit Policy : Object Access > Audit Registry (Success)"
detection:
  selection:
    EventID: 4657
    ObjectName|contains|all:
      - \REGISTRY\MACHINE\SYSTEM
      - ControlSet
      - \Control\Lsa
    ObjectValueName:
      - LmCompatibilityLevel
      - NtlmMinClientSec
      - RestrictSendingNTLMTraffic
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Windows Security Event ID 4657 registry modifications affecting LSA NetNTLM compatibility and NTLM security settings. Specifically, it matches changes to values under HKLM\SYSTEM\ControlSet\Control\Lsa that control LM compatibility, minimum client security, and whether NTLM traffic can be restricted. Attackers may alter these parameters to force weaker NTLM negotiation and compatibility, reducing security and enabling follow-on access or credential abuse. Telemetry relies on the Security log’s registry object change events that include the affected registry path and value names.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.