Detection of DisableRestrictedAdmin Registry Value Tampering

Adversaries modify the Windows registry key DisableRestrictedAdmin to lower the security posture of Remote Desktop (RDP) connections. When this registry value is set to 0, it enables RestrictedAdmin mode, which prevents the transmission of plaintext or cached credentials to the remote target. By tampering with this configuration (typically via registry modification commands like reg.exe or PowerShell), attackers aim to disable this protection. This allows them to harvest reusable credentials when a user initiates an RDP connection to a compromised host, potentially leading to lateral movement and privilege escalation within the network. This technique is often observed as part of post-exploitation activity where attackers attempt to maintain access or expand their footprint across an environment. Monitoring for modifications to this specific Local Security Authority (LSA) registry path is a critical detective control for identifying credential harvesting attempts.

Impact

Successful tampering with the DisableRestrictedAdmin registry key compromises the integrity of RDP sessions, directly exposing user credentials to harvest on remote systems. If achieved, this enables attackers to capture high-value administrative credentials, significantly increasing the risk of domain-wide compromise and persistent unauthorized access across the Windows environment.

Recommendation

Detection engineering teams should monitor for unauthorized modifications to the LSA registry hive related to Remote Desktop security configurations.

• Deploy the provided Sigma rule to detect command-line processes targeting the LSA registry path for DisableRestrictedAdmin.
• Audit existing Group Policy Objects (GPOs) to ensure RestrictedAdmin mode is enforced globally and that registry modifications are restricted via Endpoint Detection and Response (EDR) or AppLocker policies.
• Review historical logs for process execution of 'reg.exe' or 'powershell.exe' containing the path 'System\CurrentControlSet\Control\Lsa\DisableRestrictedAdmin'.