Registry write to an LSA package list or LSA extension key

1title: Registry write to an LSA package list or LSA extension key2id: c8cb20b9-e191-40d5-8ce2-79b76b2ac6443status: experimental4description: |5  Detects a registry value being set on one of the lists that decide which DLLs6  LSASS loads. Adding a name to any of them is the persistence write MITRE7  describes in AN0629, but only one arm is T1547.008: Authentication Packages,8  which is also the key MITRE's RegistryKeyScope knob names. The neighbours are9  kept because the write is indistinguishable in this telemetry and an analyst10  wants them in the same queue — Notification Packages is the password filter11  key (T1556.002), Security Packages and OSConfig\Security Packages are the12  Security Support Provider keys (T1547.005), and Control\LsaExtensionConfig is13  the LSA extension subtree, which is a sibling of Control\Lsa rather than a14  child of it and must be matched as its own path. The whole rule is a single15  `TargetObject` OR so every backend renders it, and the hive prefix is left out16  of the match because Sysmon and the Security channel spell it differently; on17  Defender data the rendered KQL lands on DeviceRegistryEvents.RegistryKey,18  which carries the same string.19  Two blind spots. The rule sees only the registry write, so the variant that20  overwrites the DLL already named in Authentication Packages on disk — the21  Hijack Execution Flow route the technique description calls out — writes no22  registry value and produces nothing here; Security 3033 (an LSA code-integrity23  load failure) and the brief's file_event, file_change and driver_load sources24  are the companion telemetry for that leg. And the analytic's correlation, this25  write followed by an unsigned DLL loading into lsass.exe at the next boot26  inside TimeWindow, is not expressible in Sigma.27  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0225, not hand-written and not tested by its author. Any lab result is on this rule's own page.28references:29  - https://attack.mitre.org/techniques/T1547/00830  - https://attack.mitre.org/detectionstrategies/DET022531author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)32date: 2026-08-1633tags:34  - attack.persistence35  - attack.privilege-escalation36  - attack.t1547.00837  - attack.t1547.00538  - attack.t1556.00239logsource:40  category: registry_set41  product: windows42detection:43  selection:44    TargetObject|contains:45      - '\Control\Lsa\Authentication Packages'46      - '\Control\Lsa\Notification Packages'47      - '\Control\Lsa\Security Packages'48      - '\Control\Lsa\OSConfig\Security Packages'49      - '\Control\LsaExtensionConfig\'50  condition: selection51falsepositives:52  - "Password filter and multi-factor authentication products being installed or upgraded. Their installers legitimately append a DLL name to Notification Packages, and a smartcard or federation agent does the same to Security Packages. MITRE's FileHashAllowList and ImagePathPattern knobs are aimed at this case — the value written names the DLL, so allowlist the specific package name your estate deploys rather than muting the key."53  - "Entra ID join and Windows Hello for Business enrolment, which register the cloud authentication provider in Security Packages. It is one write per device, but a hybrid-join or WHfB rollout turns that into a fleet-wide burst over the days the enrolment wave runs."54  - "Domain controller promotion and demotion, plus Credential Guard and RDP security feature changes, which rewrite the package lists as part of a supported Windows role or feature change."55  - "Windows components registering LSA extensions under Control\\LsaExtensionConfig — that arm matches the whole subtree, so any in-box provider written during setup, servicing or a feature update lands in the queue."56level: medium