MaxMpxCt Registry Value Changed

SigmaHQ Detections@sigmaHQ

•updated Feb 3, 2025•0•16

Detects changes to the "MaxMpxCt" registry value, which specifies the maximum outstanding network requests for the server per client when negotiating an SMB connection. Ransomware threat actors, specifically BlackCat, have been observed increasing this value to handle a higher volume of traffic, potentially for data exfiltration or other high-volume network activities.