Sagan unknown stable other

[WINDOWS-SYSMON] Windows Registry - Restricted Admin Mode Enabled (Sysmon RegistryEvent) - Critical

[WINDOWS-SYSMON] Windows Registry - Restricted Admin Mode Enabled (Sysmon RegistryEvent) - Critical

View Source

Detection Logic

alert any any any -> any any (msg:"[WINDOWS-SYSMON] Windows Registry - Restricted Admin Mode Enabled (Sysmon RegistryEvent) - Critical"; program:*Sysmon*; event_id:13; pcre:"/TargetObject.*HKLM\\System\\CurrentControlSet\\Control\\Lsa\\DisableRestrictedAdmin/i"; pcre:"/Details.*(0x00000000
| DWORD.*0)/i"; classtype:privilege-escalation; sid:5017385; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...