T1556.001No distinct observable

Domain Controller Authentication

Defense Impairment · Persistence · Credential AccessWindows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

AN0757 is a three-way correlation -- LSASS process access, an authentication-DLL module load, and a subsequent abnormal logon pattern within a TimeWindow -- and Sigma has no correlation operator to hold it together, so each leg has to stand alone as a single-event selection. None does. The process_access leg (Sysmon EID10) would have to gate on GrantedAccess, but the write-capable masks that distinguish an injection/patch attempt from a read are already the exact masks T1003.001's published rule matches against lsass.exe (0x1438 and 0x143A both carry the VM_WRITE bit); this brief's mutableElements -- MonitoredDLLs, TimeWindow, UserContext -- name no AccessMask knob of its own, so a second rule on the same field and logsource would not add a distinct observable, only restate T1003.001 under a different technique ID. […]

Covered instead by T1003.001, T1556.002.

What the technique is

Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts. Malware may be used to inject false credentials into the authentication process on a domain controller with the intent of creating a backdoor used to access any user’s account and/or credentials (ex: Skeleton Key). Skeleton key works through a patch on an enterprise domain controller authentication process (LSASS) with credentials that adversaries may use to bypass the standard authentication system. Once patched, an adversary can use the injected password to successfully authenticate as any domain user account (until the the skeleton key is erased from memory by a reboot of the domain controller). Authenticated access may enable unfettered access to hosts and/or resources within single-factor authentication environments.

Read it on attack.mitre.org

What MITRE says you would watch

AN0757
Detects anomalous process access to LSASS on domain controllers, suspicious module loads of authentication DLLs, and registry or file modifications indicative of Skeleton Key–style patching. Correlates LSASS access attempts with subsequent abnormal logon activity patterns.