NetNTLM Downgrade Attack via Registry Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•25

This rule detects attempts to downgrade NetNTLM security settings by monitoring modifications to specific registry keys related to LSA (Local Security Authority) configuration. Specifically, it looks for changes to 'LmCompatibilityLevel', 'NtlmMinClientSec', and 'RestrictSendingNTLMTraffic' within the 'SYSTEM\ControlSet\Control\Lsa' registry path. Such modifications can weaken NTLM authentication security, potentially enabling downgrade attacks where an attacker forces a less secure authentication protocol.