LSA Authentication Packages registry value modified

1title: LSA Authentication Packages registry value modified2id: 85ed0a5f-03c7-4ef5-893f-bc91260afe193status: experimental4description: |5  Matches the registry leg of AN0583: a write to the `Authentication Packages`6  value under HKLM\SYSTEM\CurrentControlSet\Control\Lsa, which is the one place a7  DLL name has to be added for LSA to load it into lsass.exe at the next boot,8  and therefore the moment this persistence is established. The OSConfig copy of9  the value is listed separately because that subkey sits between `Lsa` and the10  value name, so a single contains on the shorter path does not reach it. Two11  neighbouring values that MITRE's `RegistryPathScope` knob invites you to add12  are deliberately left out: `Security Packages` is T1547.005, already published13  in this corpus with its own rule, and `Notification Packages` is T1556.002 —14  folding either in here would file another technique's observable behind this15  tag. What the rule cannot do: `Authentication Packages` is a REG_MULTI_SZ, and16  Sysmon EventID 13 renders anything that is not a string, DWORD or QWORD as the17  literal `Binary Data`, so `Details` shows neither the new package list nor the18  previous one. An inserted DLL therefore cannot be told from a rewrite that19  stores the default `msv1_0` list unchanged, no gate on `Details` is attempted,20  and the added name has to be read off the host during triage. The analytic's second half — lsass.exe21  loading an unsigned or non-baseline DLL, Sysmon EventID 7 — is a separate event22  MITRE's `TimeWindow` knob correlates across a reboot, which lib/sigma cannot23  express, and its `ImageSignatureStatus` knob is a per-host allowlist a rule24  cannot carry. Vocabulary matters for deployment: the brief maps Security25  EventID 4657 onto the Sysmon-shaped `registry_set` category, and this rule is26  written in the Sysmon EventID 13 vocabulary, where the key and the value name27  are joined in a single `TargetObject`. A 4657 feed splits those into28  `ObjectName` and `ObjectValueName`, so it needs a field mapping before this29  rule can match at all — enabling Audit Registry and a SACL on the Lsa key alone30  will not make it fire. On the Sysmon side, confirm the running configuration31  actually includes this key: volume-trimmed configs commonly watch a short32  allowlist of autostart locations, and one that omits Lsa leaves the rule silent33  rather than quiet.34  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0207, not hand-written and not tested by its author. Any lab result is on this rule's own page.35references:36  - https://attack.mitre.org/techniques/T1547/00237  - https://attack.mitre.org/detectionstrategies/DET020738author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)39date: 2026-08-1640tags:41  - attack.persistence42  - attack.privilege-escalation43  - attack.t1547.00244logsource:45  category: registry_set46  product: windows47detection:48  selection:49    TargetObject|contains:50      - '\Control\Lsa\Authentication Packages'51      - '\Control\Lsa\OSConfig\Authentication Packages'52  condition: selection53falsepositives:54  - "Windows servicing that rewrites the whole REG_MULTI_SZ value instead of editing it — in-place feature upgrades and repair installs — which emit a matching write even when the resulting package list is identical to the old one. This is a per-machine event at upgrade time rather than an estate-wide wave; an ordinary cumulative update does not touch this value, and neither does enabling Credential Guard, which writes LsaCfgFlags and RunAsPPL instead."55  - "Installation or upgrade of third-party authentication software that legitimately registers its own authentication package: smart-card and biometric middleware, enterprise SSO clients and some MFA agents, one write per product per install from the vendor's installer process."56  - "Golden-image build and re-imaging: MDT or SCCM task sequences, Packer runs and configuration-management policies that apply an LSA baseline, producing a burst of identical writes from every machine built that day."57  - "Baseline remediation by a configuration-management engine that reapplies a stored package list through the registry API, rewriting the value with its own previous contents — an offline hive restore is not in scope here, because swapping a SYSTEM hive emits no per-value write event."58level: high