LSA Authentication Packages registry value modified

Siemphony@siemphonyhighT1547.002unverified

Matches the registry leg of AN0583: a write to the `Authentication Packages` value under HKLM\SYSTEM\CurrentControlSet\Control\Lsa, which is the one place a DLL name has to be added for LSA to load it into lsass.exe at the next boot, and therefore the moment this persistence is established. The OSConfig copy of the value is listed separately because that subkey sits between `Lsa` and the value name, so a single contains on the shorter path does not reach it. Two neighbouring values that MITRE's `RegistryPathScope` knob invites you to add are deliberately left out: `Security Packages` is T1547.005, already published in this corpus with its own rule, and `Notification Packages` is T1556.002 — folding either in here would file another technique's observable behind this tag. What the rule cannot do: `Authentication Packages` is a REG_MULTI_SZ, and Sysmon EventID 13 renders anything that is not a string, DWORD or QWORD as the literal `Binary Data`, so `Details` shows neither the new package list nor the previous one. An inserted DLL therefore cannot be told from a rewrite that stores the default `msv1_0` list unchanged, no gate on `Details` is attempted, and the added name has to be read off the host during triage. The analytic's second half — lsass.exe loading an unsigned or non-baseline DLL, Sysmon EventID 7 — is a separate event MITRE's `TimeWindow` knob correlates across a reboot, which lib/sigma cannot express, and its `ImageSignatureStatus` knob is a per-host allowlist a rule cannot carry. Vocabulary matters for deployment: the brief maps Security EventID 4657 onto the Sysmon-shaped `registry_set` category, and this rule is written in the Sysmon EventID 13 vocabulary, where the key and the value name are joined in a single `TargetObject`. A 4657 feed splits those into `ObjectName` and `ObjectValueName`, so it needs a field mapping before this rule can match at all — enabling Audit Registry and a SACL on the Lsa key alone will not make it fire. On the Sysmon side, confirm the running configuration actually includes this key: volume-trimmed configs commonly watch a short allowlist of autostart locations, and one that omits Lsa leaves the rule silent rather than quiet. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0207, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceRegistryEvents| where (RegistryKey contains "\\Control\\Lsa\\Authentication Packages" or RegistryKey contains "\\Control\\Lsa\\OSConfig\\Authentication Packages")

Splunk · SPL

Run this as a search.

index=* (TargetObject="*\\Control\\Lsa\\Authentication Packages*" OR TargetObject="*\\Control\\Lsa\\OSConfig\\Authentication Packages*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(registry.path) LIKE "*\\\\control\\\\lsa\\\\authentication packages*" OR TO_LOWER(registry.path) LIKE "*\\\\control\\\\lsa\\\\osconfig\\\\authentication packages*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,registry_set,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)(\\Control\\Lsa\\Authentication Packages|\\Control\\Lsa\\OSConfig\\Authentication Packages)</field>    <description>LSA Authentication Packages registry value modified</description>    <mitre>      <id>T1547.002</id>    </mitre>  </rule></group>

At a glance

Logsource: registry_set / windows
Level: high
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 85ed0a5f-03c7-4ef5-893f-bc91260afe19

ATT&CKT1547.002

T1547.002Authentication Package

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

AN0583 describes a two-part chain: a write to the LSA Authentication Packages value, followed by lsass.exe loading a non-baseline or unsigned DLL. This rule implements the first part and stops. That is the right half to take — the value under HKLM\SYSTEM\CurrentControlSet\Control\Lsa is the one place a DLL name has to be added for LSA to load it at the next boot, so the write is the moment the persistence is established. The second half needs Sysmon EventID 7 and MITRE's TimeWindow knob to join it across a reboot, which lib/sigma cannot express, and its ImageSignatureStatus knob is a per-host allowlist no shipped rule can carry.

02 · Telemetry you need

category: registry_set / product: windows, copied verbatim from AN0583.
Vocabulary decides whether this rule can fire at all. It is written in the Sysmon EventID 13 vocabulary, where key and value name are joined in one TargetObject. The brief also maps Security EventID 4657 onto the same Sigma category, but 4657 splits them into ObjectName and ObjectValueName — so a 4657 feed needs a field mapping first. Enabling Audit Registry and a SACL on the Lsa key alone will not make this rule match.
On the Sysmon side, confirm the running config actually includes this key: volume-trimmed configs watch a short allowlist of autostart locations, and one omitting Lsa leaves the rule silent rather than quiet. All four backends render.

03 · How the logic works

One selection, one field, two values: TargetObject|contains: - '\Control\Lsa\Authentication Packages' - '\Control\Lsa\OSConfig\Authentication Packages' Because EID 13's TargetObject is key-plus-value, anchoring the substring on \Authentication Packages hits the value, not a subkey. Starting the match at \Control\ rather than at the hive root is deliberate: it survives ControlSet001 versus CurrentControlSet, which a full-path match would not. The second value exists because the OSConfig subkey sits between Lsa and the value name, so a single contains on the shorter path cannot reach it. MITRE's RegistryPathScope knob invites you to add neighbouring values. Two are deliberately excluded: Security Packages is T1547.005, already published here with its own rule, and Notification Packages is T1556.002. Folding either in would file another technique's observable behind this tag. The hard limit to internalise: Authentication Packages is a REG_MULTI_SZ, and Sysmon renders anything that is not a string, DWORD or QWORD as the literal Binary Data. So Details shows neither the new package list nor the old one. An inserted DLL cannot be told from a rewrite that stores the default msv1_0 unchanged, no gate on Details is attempted, and an allowlist built on that field would match nothing. The added name has to be read off the host during triage.

04 · Common false positives

Rarely — this value is close to write-once, which is why level: high holds. Windows servicing that rewrites the whole multi-string emits a match even when the result is identical, but that means in-place feature upgrades and repair installs: per-machine, at upgrade time. An ordinary cumulative update does not touch this value, and neither does enabling Credential Guard, which writes LsaCfgFlags and RunAsPPL instead. Then third-party authentication software — smart-card and biometric middleware, SSO clients, some MFA agents — one write per install. Then golden-image builds applying an LSA baseline, in a burst. Then config-management remediation reapplying a stored list. An offline hive restore is not a false positive: swapping a SYSTEM hive emits no per-value write event.

05 · Detection maturity

tier_1: , and it stays there until it has been run against real data. Everything above is reasoning about a selector, not measurement.
tier_2: run read-only across a full patch and imaging cycle, and record who legitimately writes this value in your estate.
tier_3: ** correlate the write with the subsequent lsass.exe load inside MITRE's TimeWindow, so the alert names the DLL rather than only the key.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Do not allowlist on Details; it says Binary Data. Use MITRE's
Suppress by change window where you can; upgrade and imaging bursts are
Pair with an EID 7 rule on lsass.exe module loads and triage the two

Declared by the author

Windows servicing that rewrites the whole REG_MULTI_SZ value instead of editing it — in-place feature upgrades and repair installs — which emit a matching write even when the resulting package list is identical to the old one. This is a per-machine event at upgrade time rather than an estate-wide wave; an ordinary cumulative update does not touch this value, and neither does enabling Credential Guard, which writes LsaCfgFlags and RunAsPPL instead.
Installation or upgrade of third-party authentication software that legitimately registers its own authentication package: smart-card and biometric middleware, enterprise SSO clients and some MFA agents, one write per product per install from the vendor's installer process.
Golden-image build and re-imaging: MDT or SCCM task sequences, Packer runs and configuration-management policies that apply an LSA baseline, producing a burst of identical writes from every machine built that day.
Baseline remediation by a configuration-management engine that reapplies a stored package list through the registry API, rewriting the value with its own previous contents — an offline hive restore is not in scope here, because swapping a SYSTEM hive emits no per-value write event.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1547.002, evaluated against their registry_set events.

Share this rule

/u/siemphony/85ed0a5f-03c7-4ef5-893f-bc91260afe19

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

LSA Authentication Packages registry value modified

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it