Windows Security: Registry NetNTLM Downgrade Configuration Changes

Alerts on Windows registry changes that weaken NetNTLM/NTLM security settings via LSA compatibility and restriction values.

FreeReviewedSigma · High · v2

Product: windows
Service: security
Author: Florian Roth (Nextron Systems), wagga (SigmaHQ), DRL 1.1
Published: 2018-03-20
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Persistence → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1112Modify Registry
Priv Esc
Defense Evasion
- T1112Modify Registry
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows Security events where registry values related to NetNTLM behavior are modified under the SYSTEM\ControlSet\Control\Lsa key. The affected settings (LmCompatibilityLevel, NtlmMinClientSec, RestrictSendingNTLMTraffic) are commonly used to weaken or constrain NTLM authentication controls, which can enable follow-on access attempts. It relies on Security audit telemetry for registry object access (EventID 4657) including the target registry path and the specific value names changed.

Reporting behind it

Related detections9 linkedT1112 — drag to rearrange

Suspicious Registry Value under Console WindowsUpdates for C2 Storage

Suspicious Office VBA Object Model Access Enabled via Registry (via registry_set)

Suspicious PowerShell Payload Staging in HKCU Printers Registry Key

Suspicious Rootkit Configuration Registry Keys (via registry_set)

Suspicious Disabling of Chromium App-Bound Encryption via Policy Registry Key (via registry_set)

Windows reg.exe Registry Tampering of Internal Tool and Explorer Policy Settings (T1112)

Suspicious Disabling of Restricted Admin Mode via Registry (via registry_set)

Malicious WDigest UseLogonCredential Enabled for Cleartext Credential Theft (via registry_set)

Suspicious ClickFix RunMRU Entry Recording LOLBIN Command from Run Dialog

Windows Security: Registry NetNTLM Downgrade Configuration Changes

Pivot detection · T1112 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-registry-netntlm-compatibilitylevel-and-ntlm-security-downgrade-d3abac66

title: "Windows Security: Registry NetNTLM Downgrade Configuration Changes"
id: a31c282d-da1f-4105-9983-0ee7a089fd87
related:
  - id: d67572a0-e2ec-45d6-b8db-c100d14b8ef2
    type: derived
  - id: d3abac66-f11c-4ed0-8acb-50cc29c97eed
    type: derived
status: test
description: This rule identifies Windows Security events where registry values related to NetNTLM behavior are modified under the SYSTEM\ControlSet\Control\Lsa key. The affected settings (LmCompatibilityLevel, NtlmMinClientSec, RestrictSendingNTLMTraffic) are commonly used to weaken or constrain NTLM authentication controls, which can enable follow-on access attempts. It relies on Security audit telemetry for registry object access (EventID 4657) including the target registry path and the specific value names changed.
references:
  - https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_net_ntlm_downgrade.yml
author: Florian Roth (Nextron Systems), wagga, Huntrule Team
date: 2018-03-20
modified: 2022-10-09
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1685
  - attack.t1112
logsource:
  product: windows
  service: security
  definition: "Requirements: Audit Policy : Object Access > Audit Registry (Success)"
detection:
  selection:
    EventID: 4657
    ObjectName|contains|all:
      - \REGISTRY\MACHINE\SYSTEM
      - ControlSet
      - \Control\Lsa
    ObjectValueName:
      - LmCompatibilityLevel
      - NtlmMinClientSec
      - RestrictSendingNTLMTraffic
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL