Windows Registry: LSA Extensions Multi-SZ DLL Persistence (REG_MULTI_SZ)
Alerts on registry edits to LSA extension DLL entries under LsaSrv\Extensions that can support persistence through lsass.exe loading.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-21
- Updated
- 2026-07-30
What it detects
This rule flags changes to the LSA Extensions configuration where the registry path under LsaSrv\Extensions is modified. By updating the REG_MULTI_SZ “Extensions” value to include a custom DLL filename, an attacker can arrange for lsass.exe to load that DLL via LSA extension initialization. It relies on registry set telemetry capturing the affected TargetObject path on Windows.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-lsa-extensions-multi-sz-dll-persistence-reg-multi-sz-41f6531d
title: "Windows Registry: LSA Extensions Multi-SZ DLL Persistence (REG_MULTI_SZ)"
id: f573c659-496a-443a-943d-9baf2d258eb8
status: test
description: This rule flags changes to the LSA Extensions configuration where the registry path under LsaSrv\Extensions is modified. By updating the REG_MULTI_SZ “Extensions” value to include a custom DLL filename, an attacker can arrange for lsass.exe to load that DLL via LSA extension initialization. It relies on registry set telemetry capturing the affected TargetObject path on Windows.
references:
- https://persistence-info.github.io/Data/lsaaextension.html
- https://twitter.com/0gtweet/status/1476286368385019906
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_lsa_extension.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2023-08-17
tags:
- attack.persistence
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \SYSTEM\CurrentControlSet\Control\LsaExtensionConfig\LsaSrv\Extensions
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 41f6531d-af6e-4c6e-918f-b946f2b85a36
type: derived