Add more keys concerned with lsa ppl protection

[swachchhanda000]

Summary of the Pull Request

Add more keys concerned with lsa ppl protection

Changelog

update: LSA PPL Protection Disabled Via Reg.EXE - Add more keys regarding LSA PPL

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[phantinuss]

What is filtered here? Can you give an example? (Is it a main or optional filter?)

[swachchhanda000]

When modifying the registry using the reg command, you can pass a value using either of the following formats:

/d 0 /d 00000000

For example:

The intention of rule is to catch this commandline

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "RunAsPPL" /t REG_DWORD /d "0"

But, This means the rule will be triggered if the value is set like this:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "RunAsPPL" /t REG_DWORD /d "00000001"

or similarly with other non-zero DWORD values like "00000002".

[phantinuss]

1. so it's a main filter
2. maybe you can rewrite the rule to be more robust? Maybe it works without this filter. It's a regex if it has to be.
3. maybe use /v /d with windash

[swachchhanda000]

I just find out we cannot really use this logic too as it is also possible to use 0x0

[nasbench]

You should care about any modification of these key/values via CLI. So drop the filter.

And move the rule to medium