Skip to content

Add more keys concerned with lsa ppl protection #5399

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
swachchhanda000 wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Add more keys concerned with lsa ppl protection #5399

Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
02bc0eb
Add more keys concerned with lsa ppl protection
swachchhanda000 May 1, 2025
8e80e2c
add filter
swachchhanda000 May 1, 2025
3dc0e44
Apply suggestions from code review
swachchhanda000 May 21, 2025
36f8785
Merge branch 'master' into lsa_ppl_disabled
swachchhanda000 Dec 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 20 additions & 6 deletions rules/windows/process_creation/proc_creation_win_reg_lsa_ppl_protection_disabled.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,16 @@
title: LSA PPL Protection Disabled Via Reg.EXE
id: 8c0eca51-0f88-4db2-9183-fdfb10c703f9
status: test
description: Detects the usage of the "reg.exe" utility to disable PPL protection on the LSA process
description: |
Detects the usage of "reg.exe" to disable Protected Process Light (PPL) protection for LSA (Local Security Authority) process.
LSA Protection is a security feature in Windows that prevents unauthorized access to LSA process memory using PPL technology.
Attackers often try to disable this protection to enable credential dumping tools like Mimikatz to access LSASS process memory.
references:
- https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
author: Florian Roth (Nextron Systems)
- https://github.com/shoober420/windows11-scripts/blob/38d83331738cd713ccb42f2c4557d17a27aefd98/Windows11Tweaks.bat#L1825
author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2022-03-22
modified: 2023-03-26
modified: 2025-05-01
tags:
- attack.defense-evasion
- attack.t1562.010
Expand All @@ -21,9 +25,19 @@ detection:
CommandLine|contains: 'SYSTEM\CurrentControlSet\Control\Lsa'
CommandLine|contains|all:
- ' add '
- ' /d 0'
- ' /v RunAsPPL '
condition: all of selection_*
- 'd '
- 'v '
- '0'
selection_key:
CommandLine|contains:
- 'IsPplAutoEnabled'
- 'RunAsPPL'
- 'RunAsPPLBoot'
filter:
CommandLine|contains:
- "01"
- "02"
Comment on lines +36 to +39
Copy link
Collaborator

@phantinuss phantinuss May 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is filtered here? Can you give an example? (Is it a main or optional filter?)

Copy link
Collaborator Author

@swachchhanda000 swachchhanda000 May 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When modifying the registry using the reg command, you can pass a value using either of the following formats:

/d 0 /d 00000000

For example:

The intention of rule is to catch this commandline

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "RunAsPPL" /t REG_DWORD /d "0"

But, This means the rule will be triggered if the value is set like this:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v "RunAsPPL" /t REG_DWORD /d "00000001"

or similarly with other non-zero DWORD values like "00000002".

Copy link
Collaborator

@phantinuss phantinuss Dec 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. so it's a main filter
  2. maybe you can rewrite the rule to be more robust? Maybe it works without this filter. It's a regex if it has to be.
  3. maybe use /v /d with windash

Copy link
Collaborator Author

@swachchhanda000 swachchhanda000 Dec 26, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just find out we cannot really use this logic too as it is also possible to use 0x0

Copy link
Member

@nasbench nasbench Jan 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You should care about any modification of these key/values via CLI. So drop the filter.

And move the rule to medium

condition: all of selection_* and not filter
falsepositives:
- Unlikely
level: high
Loading