LSA PPL Protection Disabled Via Reg.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•24

Detects the use of the 'reg.exe' utility to disable Protected Process Light (PPL) protection for the Local Security Authority (LSA) process. This modification can allow attackers to dump LSA secrets, which contain credential material.