Sigma rule: Directory Service Restore Mode(DSRM) Registry Value Tampering

Rule

Title

Directory Service Restore Mode(DSRM) Registry Value Tampering

Status

test

Level

high

Author

Nischal Khadgi

Date

2024-07-11

File

rules/windows/registry/registry_set/registry_set_dsrm_tampering.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects changes to "DsrmAdminLogonBehavior" registry value.
During a Domain Controller (DC) promotion, administrators create a Directory Services Restore Mode (DSRM) local administrator account with a password that rarely changes. The DSRM account is an “Administrator” account that logs in with the DSRM mode when the server is booting up to restore AD backups or recover the server from a failure.
Attackers could abuse DSRM account to maintain their persistence and access to the organization's Active Directory.
If the "DsrmAdminLogonBehavior" value is set to "0", the administrator account can only be used if the DC starts in DSRM.
If the "DsrmAdminLogonBehavior" value is set to "1", the administrator account can only be used if the local AD DS service is stopped.
If the "DsrmAdminLogonBehavior" value is set to "2", the administrator account can always be used.

Log source

product

windows

category

registry_set

Detection

selection:
    TargetObject|endswith: '\Control\Lsa\DsrmAdminLogonBehavior'
filter_main_default_value:
    Details: 'DWORD (0x00000000)' # Default value
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.credential-access
• attack.persistence
• attack.defense-impairment
• attack.t1556

MITRE ATT&CK ids this rule names

• T1556

Related rules

• 53ad8e36-f573-46bf-97e4-15ba5bf4bb51 (similar)

References

• https://adsecurity.org/?p=1785
• https://www.sentinelone.com/blog/detecting-dsrm-account-misconfigurations/
• https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/dsrm-credentials

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/registry/registry_set/registry_set_dsrm_tampering.yml