LSA Security Packages registry value modified

Siemphony@siemphonyhighT1547.005verified in lab

Matches a write to either of the two registry values AN1495 names as the SSP configuration — HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and the OSConfig copy of the same value — which is where a DLL name has to land for LSA to load it into lsass.exe at the next boot. The two paths are listed separately because the OSConfig key sits between Lsa and the value name, so a single contains on the shorter path does not cover it. What the rule cannot do is tell an insertion from a rewrite: registry_set carries the new multi-string in Details but never the previous contents, so any write to the value matches, including one that stores the list unchanged. The rest of the analytic is out of reach as well — the Sysmon EventID 7 leg (an unsigned or anomalous DLL loading into lsass.exe) is a separate event that MITRE's TimeWindow knob correlates across a reboot, which lib/sigma cannot express, and the AddSecurityPackage API route loads a package into a running LSA with no registry write at all, so it produces nothing here. Vocabulary matters for deployment: the brief maps Security EventID 4657 onto the Sysmon-shaped registry_set category, and this rule is written in the Sysmon EventID 13 vocabulary, with the key and value name joined in a single TargetObject. A 4657 feed splits those into ObjectName and ObjectValueName, so it needs a field mapping before this rule can match at all — enabling Audit Registry and a SACL on the key alone will not make it fire. On the Sysmon side, confirm the running configuration actually includes the Lsa key: volume-trimmed configs commonly watch only a short list of autostart locations, and one that omits this key leaves the rule silent rather than quiet. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0542, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceRegistryEvents| where (RegistryKey contains "\\Control\\Lsa\\Security Packages" or RegistryKey contains "\\Control\\Lsa\\OSConfig\\Security Packages")

Splunk · SPL

Run this as a search.

index=* (TargetObject="*\\Control\\Lsa\\Security Packages*" OR TargetObject="*\\Control\\Lsa\\OSConfig\\Security Packages*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(registry.path) LIKE "*\\\\control\\\\lsa\\\\security packages*" OR TO_LOWER(registry.path) LIKE "*\\\\control\\\\lsa\\\\osconfig\\\\security packages*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,registry_set,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)(\\Control\\Lsa\\Security Packages|\\Control\\Lsa\\OSConfig\\Security Packages)</field>    <description>LSA Security Packages registry value modified</description>    <mitre>      <id>T1547.005</id>    </mitre>  </rule></group>

At a glance

Logsource: registry_set / windows
Level: high
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: ae3c2210-7ca2-48df-8e1c-94e607837dc1

ATT&CKT1547.005

T1547.005Security Support Provider

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

A write to the LSA Security Packages registry value — the list LSA reads at boot to decide which Security Support Provider DLLs to load into lsass.exe. Appending a DLL name here is how an adversary gets code running inside the process that holds credential material, and it survives reboots. The rule matches any write to that value, on either of the two paths AN1495 names. It does not attempt the DLL-load side of the analytic, and it cannot see the AddSecurityPackage API route, which loads a package into a running LSA with no registry write at all.

02 · Telemetry you need

Sigma's registry_set category for Windows, taken verbatim from AN1495 — and this is the part to read twice. The rule is written in the Sysmon EventID 13 vocabulary, where the key and the value name are joined in one TargetObject. The brief also maps Security EventID 4657 onto registry_set, but 4657 splits those into ObjectName and ObjectValueName, so a 4657 feed needs a field mapping before this rule can match at all. Enabling Audit Registry and a SACL on the Lsa key alone will not make it fire. On the Sysmon side, check that the running configuration includes the Lsa key: volume-trimmed configs commonly watch a short autostart list and nothing else.

03 · How the logic works

One selection, one field. TargetObject|contains carries two strings: \Control\Lsa\Security Packages and \Control\Lsa\OSConfig\Security Packages. They are listed separately, not collapsed into a shorter contains, because the OSConfig component sits between Lsa and the value name — a single substring on the shorter path cannot cover both. Leaving off the HKLM\SYSTEM\CurrentControlSet prefix is deliberate: it keeps the match working across ControlSet001/ControlSet002 and whatever hive prefix your collector emits. The structural limit is that registry_set carries the new value in Details and never the previous contents. The rule therefore cannot distinguish an insertion from a rewrite, and any write matches — including one that stores the identical multi-string back. Triage has to compare the observed package list against a known-good baseline out of band.

04 · Common false positives

Not often, but in bursts, and almost always benign when it does fire. Windows servicing rewrites the whole REG_MULTI_SZ value rather than editing it, so in-place upgrades, cumulative updates, and enabling Credential Guard or Windows Hello for Business all produce a matching write with an unchanged package list — arriving across the estate on patch day. Third-party authentication software legitimately registers its own package: smart-card middleware, enterprise SSO and MFA agents, credential providers. Golden-image builds and MDT/SCCM task sequences emit an identical write from every machine built that day. Backup, restore, and baseline-remediation tooling reapplies a saved SYSTEM hive value.

05 · Detection maturity

tier_1: Lowest tier. Derived from DET0542 by a machine, never executed against a log line. Its true volume, and whether your collector emits the TargetObject shape assumed above, are both unmeasured. Run it read-only across a patch cycle before trusting the high.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE names CustomSSPNameList — the allowed package values for your organisation — and that is the tuning surface that matters, but it lives downstream of this rule, in triage: the rule cannot read the list it just matched. Populate a baseline of expected package names per build, then treat any match whose Details is not on it as the real signal. MITRE's other three knobs (TimeWindow, DLLSignatureValidation, BootContextCorrelation) all belong to the Sysmon EventID 7 leg — an unsigned DLL loading into lsass.exe after a reboot — which is a separate event and a correlation lib/sigma cannot express. The level: high here reflects how rarely this value is legitimately touched outside servicing windows.

Declared by the author

Windows servicing and feature changes that rewrite the whole REG_MULTI_SZ value instead of editing it — in-place upgrades, cumulative updates and turning on Credential Guard or Windows Hello for Business — which emit a matching write even when the resulting package list is identical to the old one. This is the most common benign hit and it arrives in waves across the estate on patch day.
Installation or upgrade of third-party authentication software that legitimately registers its own security package: smart-card middleware, enterprise SSO and MFA agents, and credential-provider products, one write per product per install from the vendor's installer process.
Golden-image build and re-imaging: MDT or SCCM task sequences, Packer runs and configuration-management policies that apply an LSA baseline, producing a burst of identical writes from every machine built that day.
Backup, restore and hive-migration tooling, or baseline remediation that reapplies a saved SYSTEM hive value, rewriting the list with its own previous contents.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Verified in Siemphony lab

Security Datasets — Security Support Provider persistence
passed
Siemphony IR · 3 Sept 2026
1 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1547.005, evaluated against their registry_set events.

Share this rule

/u/siemphony/ae3c2210-7ca2-48df-8e1c-94e607837dc1

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

LSA Security Packages registry value modified

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it