Elastic medium stable eql

Potential NetNTLMv1 Downgrade Attack

Identifies registry modification to force the system to fall back to NTLMv1 for authentication. This modification is possible with local administrator privileges and is commonly referred to as a `NetNTLMv1 downgrade attack`.

View Source

Detection Logic

registry where host.os.type == "windows" and event.action != "deletion" and
 registry.value == "LmCompatibilityLevel" and registry.data.strings in ("2", "1", "0", "0x00000002", "0x00000001", "0x00000000")

Field Validations

Loading…

Comments (0)

Loading comments...