Enable LM Hash Storage

Hunt Hypothesis

Detects changes to the “NoLMHash” registry value in order to allow Windows to store LM Hashes. By setting this registry value to “0” (DWORD), Windows will be allowed to store a LAN manager hash of you

Detection Rule

Sigma (Original)

title: Enable LM Hash Storage
id: c420410f-c2d8-4010-856b-dffe21866437
related:
    - id: 98dedfdd-8333-49d4-9f23-d7018cccae53 # process_creation
      type: similar
status: test
description: |
    Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes.
    By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
    - https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password
    - https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-12-15
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|endswith: 'System\CurrentControlSet\Control\Lsa\NoLMHash'
        Details: 'DWORD (0x00000000)'
    condition: selection
falsepositives:
    - Unknown
level: high

KQL (Azure Sentinel)

imRegistry
| where RegistryKey endswith "System\\CurrentControlSet\\Control\\Lsa\\NoLMHash" and RegistryValueData =~ "DWORD (0x00000000)"

KQL (Microsoft 365 Defender)

DeviceRegistryEvents
| where RegistryKey endswith "System\\CurrentControlSet\\Control\\Lsa\\NoLMHash" and RegistryValueData =~ "DWORD (0x00000000)"

Required Data Sources

False Positive Guidance

• Unknown

MITRE ATT&CK Context

• Tactic: Persistence
• Technique: T1112 — T1112

References

• https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
• https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password
• https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/
• SigmaHQ Rule