Directory Service Restore Mode (DSRM) Registry Value Tampering

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•14

This rule detects modifications to the "DsrmAdminLogonBehavior" registry value. Attackers may modify this value to abuse the Directory Services Restore Mode (DSRM) administrator account for persistence and access to Active Directory. The DSRM account is a local administrator account on a Domain Controller, typically used for restoring AD backups or recovering from failures. By changing "DsrmAdminLogonBehavior" from its default value of '0' (only usable in DSRM) to '1' (usable when AD DS service is stopped) or '2' (always usable), attackers can gain persistent access to the Domain Controller outside of DSRM, facilitating credential access and defense evasion.