Windows EnableLinkedConnections Registry Modification

The EnableLinkedConnections registry setting controls whether Windows allows network connections to be shared across different logon sessions. By modifying this key (typically located at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System) and setting it to 1, attackers can enable access to mapped network drives across both standard and administrator-level access tokens. This technique is frequently abused by post-exploitation actors, notably during BlackByte ransomware intrusions, to facilitate lateral movement and access restricted network resources that would otherwise be protected by User Account Control (UAC) filtering. Defenders should monitor for registry modifications targeting this specific path, as the setting change is rarely required for routine end-user operations.

Attack Chain

1. Initial access is established through phishing or exploitation of internet-facing services.
2. The attacker gains initial code execution, typically as a standard user.
3. The attacker identifies the need to access network shares mapped in a different security context.
4. A registry modification is performed on 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections' using reg.exe or API calls.
5. The value is set to '0x00000001' to enable linked connections.
6. The attacker leverages the now-shared network connection to access sensitive shares or sensitive data.
7. Final objective such as data exfiltration or encryption (ransomware) is executed.

Impact

Modification of this registry key significantly expands the attack surface by bypassing UAC restrictions on network shares. Successful exploitation allows an attacker to escalate their capability to interact with network resources without further authentication, often resulting in mass file encryption, data theft, or complete domain compromise within the targeted sector.

Recommendation

1. Deploy the provided Sigma rule to detect unauthorized modifications to the EnableLinkedConnections registry key.
2. Enable Sysmon Event ID 13 logging to capture registry modifications across all endpoints.
3. Investigate any process modifying the registry key outside of approved system administration toolsets or deployment software.
4. Perform a retroactive hunt for '0x00000001' values written to the EnableLinkedConnections path in registry logs.