Windows Security: Registry NetNTLM Downgrade Configuration Changes

Alerts on Windows registry changes that weaken NetNTLM/NTLM security settings via LSA compatibility and restriction values.

FreeReviewedSigma · High · v2

Product: windows
Service: security
Author: Florian Roth (Nextron Systems), wagga (SigmaHQ), DRL 1.1
Published: 2018-03-20
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Persistence → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1112Modify Registry
Priv Esc
Defense Evasion
- T1112Modify Registry
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows Security events where registry values related to NetNTLM behavior are modified under the SYSTEM\ControlSet\Control\Lsa key. The affected settings (LmCompatibilityLevel, NtlmMinClientSec, RestrictSendingNTLMTraffic) are commonly used to weaken or constrain NTLM authentication controls, which can enable follow-on access attempts. It relies on Security audit telemetry for registry object access (EventID 4657) including the target registry path and the specific value names changed.

Reporting behind it

Related detections9 linkedT1112 — drag to rearrange

Malicious Enabling of Restricted Admin Mode via Registry by UAT-8837

Suspicious Enabling of Remote Desktop via fDenyTSConnections Registry by DeadLock Ransomware

Malicious Service DLL Hijack for Persistence via Lotus Blossom

Suspicious Loopback Proxy Server Configured via Registry (via registry_set)

Malicious WDigest Credential Caching Enabled via Registry (via registry_set)

Suspicious Remote Desktop Enabled via fDenyTSConnections Registry by Sandworm

Malicious Gh0stBins RAT Registry Marker HHClient

Suspicious PebbleDash C2 Configuration Stored Under WMI Security Key (via registry_set)

Suspicious WDigest UseLogonCredential Enablement for Plaintext Credential Theft (via registry_set)

Windows Security: Registry NetNTLM Downgrade Configuration Changes

Pivot detection · T1112 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-registry-netntlm-compatibilitylevel-and-ntlm-security-downgrade-d3abac66

title: "Windows Security: Registry NetNTLM Downgrade Configuration Changes"
id: a31c282d-da1f-4105-9983-0ee7a089fd87
related:
  - id: d67572a0-e2ec-45d6-b8db-c100d14b8ef2
    type: derived
  - id: d3abac66-f11c-4ed0-8acb-50cc29c97eed
    type: derived
status: test
description: This rule identifies Windows Security events where registry values related to NetNTLM behavior are modified under the SYSTEM\ControlSet\Control\Lsa key. The affected settings (LmCompatibilityLevel, NtlmMinClientSec, RestrictSendingNTLMTraffic) are commonly used to weaken or constrain NTLM authentication controls, which can enable follow-on access attempts. It relies on Security audit telemetry for registry object access (EventID 4657) including the target registry path and the specific value names changed.
references:
  - https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_net_ntlm_downgrade.yml
author: Florian Roth (Nextron Systems), wagga, Huntrule Team
date: 2018-03-20
modified: 2022-10-09
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1685
  - attack.t1112
logsource:
  product: windows
  service: security
  definition: "Requirements: Audit Policy : Object Access > Audit Registry (Success)"
detection:
  selection:
    EventID: 4657
    ObjectName|contains|all:
      - \REGISTRY\MACHINE\SYSTEM
      - ControlSet
      - \Control\Lsa
    ObjectValueName:
      - LmCompatibilityLevel
      - NtlmMinClientSec
      - RestrictSendingNTLMTraffic
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL