title: Registry Disabling LSASS PPL
id: 8c0eca51-0f88-4db2-9183-fdfb10c703f9
status: experimental
description: Detects reg command lines that disables PPL on the LSA process
references:
    - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
author: Florian Roth
date: 2022/03/22
modified: 2022/05/09
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: \reg.exe
        CommandLine|contains: 'SYSTEM\CurrentControlSet\Control\Lsa'
        CommandLine|contains|all:
            - ' add '
            - ' /d 0'
            - ' /v RunAsPPL '
    selection_target:
        CommandLine|contains:
            - 'Real-Time Protection'
            - 'TamperProtection'
    condition: selection and selection_target
falsepositives:
    - Unlikely
level: high
tags:
    - attack.defense_evasion
    - attack.t1562.010
