Windows Registry: LSA Extensions Multi-SZ DLL Persistence (REG_MULTI_SZ)

Alerts on registry edits to LSA extension DLL entries under LsaSrv\Extensions that can support persistence through lsass.exe loading.

FreeUnreviewedSigmahighv1

windows-registry-lsa-extensions-multi-sz-dll-persistence-reg-multi-sz-41f6531d

title: "Windows Registry: LSA Extensions Multi-SZ DLL Persistence (REG_MULTI_SZ)"
id: f573c659-496a-443a-943d-9baf2d258eb8
status: test
description: This rule flags changes to the LSA Extensions configuration where the registry path under LsaSrv\Extensions is modified. By updating the REG_MULTI_SZ “Extensions” value to include a custom DLL filename, an attacker can arrange for lsass.exe to load that DLL via LSA extension initialization. It relies on registry set telemetry capturing the affected TargetObject path on Windows.
references:
  - https://persistence-info.github.io/Data/lsaaextension.html
  - https://twitter.com/0gtweet/status/1476286368385019906
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_lsa_extension.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2023-08-17
tags:
  - attack.persistence
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \SYSTEM\CurrentControlSet\Control\LsaExtensionConfig\LsaSrv\Extensions
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 41f6531d-af6e-4c6e-918f-b946f2b85a36
    type: derived

What it detects

This rule flags changes to the LSA Extensions configuration where the registry path under LsaSrv\Extensions is modified. By updating the REG_MULTI_SZ “Extensions” value to include a custom DLL filename, an attacker can arrange for lsass.exe to load that DLL via LSA extension initialization. It relies on registry set telemetry capturing the affected TargetObject path on Windows.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.