low
threat
Windows Server SMB MaxMpxCt registry configuration
BlackCat ransomware operators have been observed modifying the "MaxMpxCt" registry value to handle a higher volume of network traffic.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Low
- Sources
- 5 public sources
- Freshness
- Revision 1Nov 10, 03:09 UTC
- Source quality
- A2Roughly even chance
The "MaxMpxCt" registry value specifies the maximum outstanding network requests for the server per client, used when negotiating a Server Message Block (SMB) connection. Ransomware threat actors and operators (specifically BlackCat) have been observed increasing this value to handle a higher volume of traffic.
Notes
If the MaxMpxCt value is set beyond 125, older Windows 9x clients will fail to negotiate SMB connections.