Sagan high stable other

[WINDOWS-POWERSHELL] Windows Registry - Restricted Admin Mode Enabled via PowerShell - Critical

[WINDOWS-POWERSHELL] Windows Registry - Restricted Admin Mode Enabled via PowerShell - Critical

View Source

Detection Logic

alert any any any -> any any (msg:"[WINDOWS-POWERSHELL] Windows Registry - Restricted Admin Mode Enabled via PowerShell - Critical"; program:*Powershell*
| *Sysmon*
| *Security*; pcre:"/New-ItemProperty\s+.*-Path\s+[\"']?HKLM:\\System\\CurrentControlSet\\Control\\Lsa[\"']?\s+.*-Name\s+[\"']?DisableRestrictedAdmin[\"']?\s+.*-Value\s+[\"']?0[\"']?/i"; classtype:suspicious-command; sid:5017384; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...