Skip to content

Hide Navigation Hide TOC

LSA PPL Protection Disabled Via Reg.EXE (8c0eca51-0f88-4db2-9183-fdfb10c703f9)

Detects the usage of the "reg.exe" utility to disable PPL protection on the LSA process

Cluster A Galaxy A Cluster B Galaxy B Level
LSA PPL Protection Disabled Via Reg.EXE (8c0eca51-0f88-4db2-9183-fdfb10c703f9) Sigma-Rules Downgrade Attack - T1562.010 (824add00-99a1-4b15-9a2d-6c5683b7b497) Attack Pattern 1
Downgrade Attack - T1562.010 (824add00-99a1-4b15-9a2d-6c5683b7b497) Attack Pattern Impair Defenses - T1562 (3d333250-30e4-4a82-9edc-756c68afc529) Attack Pattern 2