Observed activity from groups such as BlackByte indicates that adversaries modify this key as part of their post-exploitation and persistence strategy. Monitoring for unauthorized changes to this registry hive provides an opportunity for defenders to intercept a critical stage of an attacker's evasion and concealment process before they execute final-stage payloads.

Attack Chain

1. Initial access is established on the target Windows system via phishing or exploitation.
2. The attacker gains administrative or SYSTEM-level privileges required to modify system-wide registry hives.
3. The attacker locates the registry key at HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\LongPathsEnabled.
4. The attacker executes a command (e.g., reg add) to set the value of LongPathsEnabled to 1.
5. The attacker creates a deeply nested directory structure exceeding 260 characters in length.
6. The attacker drops and executes malicious payloads within these nested directories to evade security scanning.
7. The objective is achieved, such as long-term persistence or data exfiltration.

Impact

Successful exploitation of this registry setting allows attackers to bypass security visibility by concealing malicious files in directory paths that standard tools cannot process. This increases the likelihood of long-term persistence and the successful execution of ransomware or other malicious payloads within an environment, potentially leading to total system compromise and data loss.

Recommendation

• Deploy the provided Sigma rule to detect any process modifying the "LongPathsEnabled" registry value.
• Establish a baseline of authorized administrative activity to reduce noise, as legitimate configuration management systems may occasionally toggle this setting.
• Enable Sysmon Event ID 13 (RegistryEvent) across all endpoints to ensure registry modifications are logged with sufficient process context.
• Audit existing systems for the current state of the LongPathsEnabled key to identify unauthorized changes that may have occurred prior to rule implementation.

Attack Chain

1. Initial access is established through phishing or exploitation of internet-facing services.
2. The attacker gains initial code execution, typically as a standard user.
3. The attacker identifies the need to access network shares mapped in a different security context.
4. A registry modification is performed on 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections' using reg.exe or API calls.
5. The value is set to '0x00000001' to enable linked connections.
6. The attacker leverages the now-shared network connection to access sensitive shares or sensitive data.
7. Final objective such as data exfiltration or encryption (ransomware) is executed.

Impact

Modification of this registry key significantly expands the attack surface by bypassing UAC restrictions on network shares. Successful exploitation allows an attacker to escalate their capability to interact with network resources without further authentication, often resulting in mass file encryption, data theft, or complete domain compromise within the targeted sector.

Recommendation

1. Deploy the provided Sigma rule to detect unauthorized modifications to the EnableLinkedConnections registry key.
2. Enable Sysmon Event ID 13 logging to capture registry modifications across all endpoints.
3. Investigate any process modifying the registry key outside of approved system administration toolsets or deployment software.
4. Perform a retroactive hunt for '0x00000001' values written to the EnableLinkedConnections path in registry logs.