kevmap

Techniques › T1547 › T1547.008

T1547.008 LSASS Driver

persistence · privilege escalation — Windows · attack.mitre.org · JSON

1
MITRE detection strategy
1
analytics
1
Sigma rules tagged attack.t1547.008
0
KEV CVEs mapped here
<p>Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.</p><p>Adversaries may target LSASS drivers to obtain persistence. By either replacing or adding illegitimate drivers (e.g., Hijack Execution Flow), an adversary can use LSA operations to continuously execute malicious payloads.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1547.008

DLL Load via LSASS hightest
Author: Florian Roth (Nextron Systems) · 2019-10-16 (modified 2022-04-21) · logsource: product=windows category=registry_event · b3503044-60ce-4bf4-bbcb-e3db98788823
Detects a method to load DLL via LSASS process using an undocumented Registry key
Techniques: T1547.008

Rules tagged at the parent level (attack.t1547) 7

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Startup/Logon Script Added to Group Policy Object mediumtest
Author: Elastic, Josh Nickels, Marius Rothenbücher · 2024-09-06 · logsource: product=windows service=security · 123e4e6d-b123-48f8-b261-7214938acaf0
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.
Techniques: T1484.001T1547
Registry Persistence Mechanisms in Recycle Bin hightest
Author: frack113 · 2021-11-18 (modified 2022-12-06) · logsource: product=windows category=registry_event · 277efb8f-60be-4f10-b4d3-037802f37167
Detects persistence registry keys for Recycle Bin
Techniques: T1547
Atbroker Registry Change mediumtest
Author: Mateusz Wydra, oscd.community · 2020-10-13 (modified 2023-01-19) · logsource: product=windows category=registry_event · 9577edbb-851f-4243-8c91-1d5b50c1a39b
Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'
Techniques: T1218T1547
Suspicious Driver Install by pnputil.exe mediumtest
Author: Hai Vaknin @LuxNoBulIshit, Avihay eldad @aloneliassaf, Austin Songer @austinsonger · 2021-09-30 (modified 2022-10-09) · logsource: product=windows category=process_creation · a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1
Detects when a possible suspicious driver is being installed via pnputil.exe lolbin
Techniques: T1547
Potential RipZip Attack on Startup Folder hightest
Author: Greg (rule) · 2022-07-21 (modified 2023-01-05) · logsource: product=windows category=file_event · a6976974-ea6f-4e97-818e-ea08625c52cb
Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder. Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.
Techniques: T1547
WINEKEY Registry Modification hightest
Author: omkar72 · 2020-10-30 (modified 2021-11-27) · logsource: product=windows category=registry_event · b98968aa-dbc0-4a9c-ac35-108363cbf8d5
Detects potential malicious modification of run keys by winekey or team9 backdoor
Techniques: T1547
Suspicious GrpConv Execution hightest
Author: Florian Roth (Nextron Systems) · 2022-05-19 · logsource: product=windows category=process_creation · f14e169e-9978-4c69-acb3-1cff8200bc36
Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors
Techniques: T1547