Detecting and Mitigating LSASS Driver Persistence (T1547.008)

LSASS Driver persistence is tracked by MITRE as T1547.008. It sits under Boot or Logon Autostart Execution, covers Persistence and Privilege Escalation, and applies to Windows.

How attackers use it

The Windows security subsystem is a set of components that enforce security policy. The Local Security Authority (LSA) is the main one, responsible for local security policy and user authentication. It includes several DLLs for security functions, and they all run inside the lsass.exe process.

MITRE describes the abuse plainly. By replacing or adding illegitimate drivers, for example through Hijack Execution Flow, an adversary can use LSA operations to run a payload again and again.

How to detect it

The detection strategy has three parts to watch together.

• Unauthorized creation or modification of DLLs that LSASS loads.
• Abnormal registry values under the LSA extension keys.
• Anomalous DLL loads into the lsass.exe process, especially around boot or logon.

Because LSASS is a small, stable process, a module list baseline is realistic. Any new module is worth a look.

How to reduce the risk

MITRE lists three mitigations.

• Credential Access Protection: on Windows 10 and Server 2016, enable Windows Defender Credential Guard so lsass.exe runs in an isolated virtualized environment without any device drivers.
• Privileged Process Integrity: on Windows 8.1 and Server 2012 R2, enable LSA Protection by setting HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL to dword:00000001. Plug-ins and drivers then load only if digitally signed by Microsoft and built to Microsoft SDL guidance.
• Restrict Library Loading: keep safe DLL search mode enabled, using HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode, to reduce the chance that lsass.exe loads a malicious library.

Quick check

Sources

• MITRE ATT&CK, Boot or Logon Autostart Execution: LSASS Driver: https://attack.mitre.org/techniques/T1547/008