1type: trigger
2name: sigmahq/proc_creation_win_reg_lsa_disable_restricted_admin
3description: |
4  Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode. RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop. This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise 
5filter: |
6  (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.CommandLine contains '\\System\\CurrentControlSet\\Control\\Lsa\\' && evt.Parsed.CommandLine contains 'DisableRestrictedAdmin')
7blackhole: 2m
8#status: test
9labels:
10  service: windows
11  confidence: 1
12  spoofable: 0
13  classification:
14   - attack.t1112
15
16  label: "RestrictedAdminMode Registry Value Tampering - ProcCreation"
17  behavior : "windows:audit"
18  remediation: false
19
20scope:
21  type: ParentProcessId
22  expression: evt.Parsed.ParentProcessId
23
24