Techniques › T1547.002 › AN0583
AN0583 Analytic 0583
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Registry modification of the LSA Authentication Packages key followed by LSASS loading a non-standard or unsigned DLL. This includes unusual write access to
HKLM\SYSTEM\CurrentControlSet\Control\Lsa, especially during non-installation timeframes. Correlated with lsass.exe loading DLLs not present in baseline or lacking valid signatures.</p>- Detects
- T1547.002 Authentication Package
- Part of
- DET0207 Detect LSA Authentication Package Persistence via Registry and LSASS DLL Load
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4657 | DC0063 Windows Registry Key Modification |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Time between registry write and DLL load; tune based on reboot cycles or scheduled maintenance |
ImageSignatureStatus | Allow listing of known signed LSASS-authenticated DLLs versus unknown/untrusted ones |
RegistryPathScope | Allow tuning for subkeys beyond just `Authentication Packages` (e.g., `Security Packages`, `Notification Packages`) |
UserContext | Correlate user responsible for registry edit; tune for expected administrative/service accounts |
ParentProcess | Validate process lineage for registry modification; expected tools like `reg.exe` or `powershell.exe` |