NetNTLM Downgrade Attack - Registry Modification
Detects modifications to specific registry keys related to NetNTLM authentication settings. These modifications can indicate an attempt to downgrade NetNTLM security, potentially enabling NetNTLM downgrade attacks. The rule specifically looks for changes to 'lmcompatibilitylevel', 'NtlmMinClientSec', and 'RestrictSendingNTLMTraffic' within the LSA registry path to less secure values.
Sigma
