Techniques › T1547.005 › AN1495
AN1495 Analytic 1495
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Monitor registry modifications to
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages or ...\OSConfig\Security Packages, especially insertions of new DLL entries. Correlate this with subsequent DLL module loads into lsass.exe. Track unsigned or anomalous DLLs loading into LSASS using image load auditing. LSASS loads unsigned DLL due to AuditLevel=8 registry configuration or System reboot followed by DLL load into lsass.exe</p>- Detects
- T1547.005 Security Support Provider
- Part of
- DET0542 Registry and LSASS Monitoring for Security Support Provider Abuse
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4657 | DC0063 Windows Registry Key Modification |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Controls how long after registry modification to expect a DLL load into LSASS (e.g., after reboot) |
DLLSignatureValidation | Use to detect unsigned DLLs or those not matching known trusted publisher certificates |
CustomSSPNameList | Define allowed SSP values for your org to reduce false positives |
BootContextCorrelation | Whether detection should correlate boot-time registry and process events |