win_disable_credential_guard.yml

title: Disable Windows Defender Credential Guard
status: experimental
description: Detects attempt to disable Windows Defender Credential Guard
references:
    - https://labs.f-secure.com/publications/ti-report-lazarus-group-cryptocurrency-vertical 
    - https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage
    - https://labs.f-secure.com/blog/catching-lazarus-threat-intelligence-to-real-detection-logic-part-two
author: F-Secure Countercept
date: 2020/09/25
level: critical

logsource:
    category: registry_event, process_creation
    product: windows

detection:
    selection1:        
        TargetObject: 'HKLM\System\CurrentControlSet\Control\LSA\LsaCfgFlags'
        EventType: 
            - 'SetValue'
            - 'AddValue'
        Details: 'DWORD (0x00000000)'

    selection2:
        Image: '*\reg.exe'
        CommandLine|contains: 'LsaCfgFlags'
    
    condition: selection1 or selection2

falsepositives:
    - Unlikely