PasamS0208 ↗
Establishes by infecting the Security Accounts Manager (SAM) DLL to load a malicious DLL dropped to disk.1
tfMITRE ATT&CK sub-technique
LSASS Driver T1547.008
sub-technique of T1547 Boot or Logon Autostart Execution
- Tactics
- Persistence, Privilege Escalation
- Platform
- Windows
- Version
- 1.1
- Created
- 24 January 2020
- Last modified
- 24 October 2025
- Contributor
- Vincent Le Toux
Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.2
Tools & malware51st pct
Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.2
Detection rules50th pct
Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.LSASS Driver MITRE reference T1547.008
51st pctamong all ATT&CK techniques for number of tools
2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
WingbirdS0176 ↗
Drops a malicious file (sspisrv.dll) alongside a copy of lsass.exe, which is used to register a service that loads sspisrv.dll as a driver. The payload of the malicious driver (located in its entry-point function) is executed when loaded by lsass.exe before the spoofed service becomes unstable and crashes.12
All 2 software entries for this technique
Offense vs defense T1547.008
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 1
first rule: 2019 Q4LSASS Driver detection strategy DET0225
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect unauthorized LSASS driver persistence via LSA plugin abuse (Windows)
1 platform
AN0629 · Windows
Unauthorized creation or modification of DLLs loaded by LSASS, abnormal registry values under LSA extensions, and anomalous DLL load activity into the lsass.exe process context—correlated during boot or logon events.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Security | EventCode=3033 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Windows Registry Key CreationDC0056 | WinEventLog:Sysmon | EventCode=12 |
| File ModificationDC0061 | WinEventLog:Sysmon | EventCode=2 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Sysmon | EventCode=13, 14 |
| Driver LoadDC0079 | WinEventLog:Sysmon | EventCode=6 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Correlate DLL file creation/modification with LSASS execution within a configurable timeframe (e.g., 5 min) |
| ImagePathPattern | Tune based on known legitimate LSASS plugin DLL paths |
| SignatureValidation | Flag unsigned DLLs loaded into lsass.exe or those signed by unexpected publishers |
| RegistryKeyScope | Scope to specific registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages |
| FileHashAllowList | Exclude known-good LSASS plugin DLLs based on cryptographic hash |
On Windows 10 and Server 2016, enable Windows Defender Credential Guard to run lsass.exe in an isolated virtualized environment without any device drivers.
On Windows 8.1 and Server 2012 R2, enable LSA Protection by setting the Registry key HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\RunAsPPL to dword:00000001. LSA Protection ensures that LSA plug-ins and drivers are only loaded if they are digitally signed with a Microsoft signature and adhere to the Microsoft Security Development Lifecycle (SDL) process guidance.
Ensure safe DLL search mode is enabled HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager\\SafeDllSearchMode to mitigate risk that lsass.exe loads a malicious code library.
Tests1ExecutorsPowerShell 1Need elevation1 of 1Have prerequisites1Have cleanup1Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition