Tampering with DisableRestrictedAdmin Registry Value

Restricted Admin mode is a security feature in Windows that prevents the transmission of reusable credentials to remote systems when using Remote Desktop (RDP). By disabling this mode via the "DisableRestrictedAdmin" registry key, an attacker can ensure that plaintext or NTLM hash credentials are sent to a compromised host, facilitating credential harvesting and lateral movement. Defenders should monitor for unauthorized modifications to this registry path, as it is a common indicator of an attacker attempting to lower the security posture of the RDP service to extract credentials from administrative sessions.

Impact

Successful modification of this setting compromises the integrity of remote administrative connections. By disabling Restricted Admin mode, attackers significantly increase the likelihood of successful credential theft via memory dumping tools like Mimikatz on a remote host, potentially leading to domain-wide account compromise and privilege escalation.

Recommendation

Deploy the provided Sigma rule to detect modifications to the LSA Restricted Admin registry configuration. Enable Registry auditing via Group Policy for the "Set Value" operation on the target key. Alert on any unauthorized changes performed by non-administrative service accounts or automated provisioning scripts.