Detecting and Mitigating Authentication Package Abuse (T1547.002)

Authentication Package abuse (MITRE ATT&CK T1547.002) is a Windows persistence and privilege escalation technique. Authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They support multiple logon processes and security protocols.

How attackers use it

MITRE explains the autostart mechanism. An adversary places a reference to a binary in the registry under HKLM\SYSTEM\CurrentControlSet\Control\Lsa\, in the Authentication Packages value. The system then runs that binary when the packages are loaded at boot.

Code that runs inside the LSA process is in a sensitive place, which is why this location deserves attention.

How to detect it

• Changes to the LSA Authentication Packages value, especially outside installation windows.
• The lsass.exe process loading a DLL that is not in your baseline or lacks a valid signature.

A read-only check from a Windows command prompt:

reg query HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v "Authentication Packages"

Compare the result across hosts of the same build.

How to reduce the risk

MITRE lists Privileged Process Integrity. On Windows 8.1, Windows Server 2012 R2 and later, LSA can run as a Protected Process Light by setting the registry value HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL. That requires all DLLs loaded by LSA to be signed by Microsoft.

Quick check

Sources

• MITRE ATT&CK T1547.002, Boot or Logon Autostart Execution: Authentication Package