Elastic high stable eql

Disabling Lsa Protection via Registry Modification

LSA protecton is provided to prevent nonprotected processes from reading memory and injecting code. This feature provides added security for the credentials that LSA stores and manages. Adversaries may modify the RunAsPPL registry and wait or initiate a system restart to enable Lsass credentials access.

View Source

Detection Logic

registry where host.os.type == "windows" and event.type == "change" and
  registry.data.strings != null and process.name != null and
  registry.value : "RunAsPPL" and
  registry.path : "*\\SYSTEM\\*ControlSet*\\Control\\Lsa\\RunAsPPL" and
  not registry.data.strings : ("1", "0x00000001", "2", "0x00000002") and
  not process.executable : "?:\\Windows\\System32\\SecurityHealthService.exe"

Field Validations

Loading…

Comments (0)

Loading comments...