Sigma rule: MaxMpxCt Registry Value Changed

Rule

Title

MaxMpxCt Registry Value Changed

Status

test

Level

low

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2024-03-19

File

rules/windows/registry/registry_set/registry_set_optimize_file_sharing_network.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects changes to the "MaxMpxCt" registry value.
MaxMpxCt specifies the maximum outstanding network requests for the server per client, which is used when negotiating a Server Message Block (SMB) connection with a client. Note if the value is set beyond 125 older Windows 9x clients will fail to negotiate.
Ransomware threat actors and operators (specifically BlackCat) were seen increasing this value in order to handle a higher volume of traffic.

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|endswith: '\Services\LanmanServer\Parameters\MaxMpxCt'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.stealth
• attack.t1070.005

MITRE ATT&CK ids this rule names

• T1070.005

References

• https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps
• https://securityscorecard.com/research/deep-dive-into-alphv-blackcat-ransomware
• https://www.intrinsec.com/alphv-ransomware-gang-analysis/?cn-reloaded=1
• https://www.sentinelone.com/labs/blackcat-ransomware-highly-configurable-rust-driven-raas-on-the-prowl-for-victims/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_optimize_file_sharing_network.yml