Enable LM Hash Storage via Process Creation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•18

Detects changes to the "NoLMHash" registry value to allow Windows to store LM Hashes. Setting this registry value to "0" (DWORD) enables the storage of LAN manager hashes of passwords in Active Directory and local SAM databases, which can facilitate 'Pass the Hash' attacks.