1. Home
  2. ATT&CK Techniques
  3. T1547.002 Authentication Package

T1547.002 Authentication Package

Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages)

Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</code> with the key value of <code>"Authentication Packages"=&lt;target binary&gt;</code>. The binary will then be executed by the system when the authentication packages are loaded.

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
DE.CM-09.01 Software and data integrity checking Mitigates T1547.002 Authentication Package
Comments
This diagnostic statement protects against Authentication Package through the use of verifying integrity of software/firmware, loading software that is trusted, ensuring privileged process integrity and checking software signatures.
References

    NIST 800-53 Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    CM-06 Configuration Settings mitigates T1547.002 Authentication Package
    SC-39 Process Isolation mitigates T1547.002 Authentication Package
    SI-03 Malicious Code Protection mitigates T1547.002 Authentication Package
    SI-07 Software, Firmware, and Information Integrity mitigates T1547.002 Authentication Package
    SI-04 System Monitoring mitigates T1547.002 Authentication Package

    VERIS Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    attribute.integrity.variety.Modify configuration Modified configuration or services related-to T1547.002 Authentication Package

    Azure Mappings

    Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
    file_integrity_monitoring Microsoft Defender for Cloud: File Integrity Monitoring technique_scores T1547.002 Authentication Package
    Comments
    This control may detect changes to the Windows registry or files that enable Boot or Logon Autostart Execution. This control at worst scans for changes on an hourly basis.
    References
    1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview