Registry write to an LSA package list or LSA extension key

Siemphony@siemphonymediumT1547.005+2verified in lab

Detects a registry value being set on one of the lists that decide which DLLs LSASS loads. Adding a name to any of them is the persistence write MITRE describes in AN0629, but only one arm is T1547.008: Authentication Packages, which is also the key MITRE's RegistryKeyScope knob names. The neighbours are kept because the write is indistinguishable in this telemetry and an analyst wants them in the same queue — Notification Packages is the password filter key (T1556.002), Security Packages and OSConfig\Security Packages are the Security Support Provider keys (T1547.005), and Control\LsaExtensionConfig is the LSA extension subtree, which is a sibling of Control\Lsa rather than a child of it and must be matched as its own path. The whole rule is a single `TargetObject` OR so every backend renders it, and the hive prefix is left out of the match because Sysmon and the Security channel spell it differently; on Defender data the rendered KQL lands on DeviceRegistryEvents.RegistryKey, which carries the same string. Two blind spots. The rule sees only the registry write, so the variant that overwrites the DLL already named in Authentication Packages on disk — the Hijack Execution Flow route the technique description calls out — writes no registry value and produces nothing here; Security 3033 (an LSA code-integrity load failure) and the brief's file_event, file_change and driver_load sources are the companion telemetry for that leg. And the analytic's correlation, this write followed by an unsigned DLL loading into lsass.exe at the next boot inside TimeWindow, is not expressible in Sigma. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0225, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceRegistryEvents| where (RegistryKey contains "\\Control\\Lsa\\Authentication Packages" or RegistryKey contains "\\Control\\Lsa\\Notification Packages" or RegistryKey contains "\\Control\\Lsa\\Security Packages" or RegistryKey contains "\\Control\\Lsa\\OSConfig\\Security Packages" or RegistryKey contains "\\Control\\LsaExtensionConfig\\")

Splunk · SPL

Run this as a search.

index=* (TargetObject="*\\Control\\Lsa\\Authentication Packages*" OR TargetObject="*\\Control\\Lsa\\Notification Packages*" OR TargetObject="*\\Control\\Lsa\\Security Packages*" OR TargetObject="*\\Control\\Lsa\\OSConfig\\Security Packages*" OR TargetObject="*\\Control\\LsaExtensionConfig\\*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(registry.path) LIKE "*\\\\control\\\\lsa\\\\authentication packages*" OR TO_LOWER(registry.path) LIKE "*\\\\control\\\\lsa\\\\notification packages*" OR TO_LOWER(registry.path) LIKE "*\\\\control\\\\lsa\\\\security packages*" OR TO_LOWER(registry.path) LIKE "*\\\\control\\\\lsa\\\\osconfig\\\\security packages*" OR TO_LOWER(registry.path) LIKE "*\\\\control\\\\lsaextensionconfig\\\\*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,registry_set,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)(\\Control\\Lsa\\Authentication Packages|\\Control\\Lsa\\Notification Packages|\\Control\\Lsa\\Security Packages|\\Control\\Lsa\\OSConfig\\Security Packages|\\Control\\LsaExtensionConfig\\)</field>    <description>Registry write to an LSA package list or LSA extension key</description>    <mitre>      <id>T1547.008</id>      <id>T1547.005</id>      <id>T1556.002</id>    </mitre>  </rule></group>

At a glance

Logsource: registry_set / windows
Level: medium
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: c8cb20b9-e191-40d5-8ce2-79b76b2ac644

ATT&CKT1547.005 +2

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistence

01 · What this rule detects

Registry values written so that attacker code is launched by Windows itself — Run and RunOnce keys, Image File Execution Options debuggers, LSA security and notification packages, COM server hijacks, AppInit_DLLs, Winlogon shell and userinit entries, and the accessibility shims that hang off IFEO. Each of these is a different key with the same purpose: something the operating system reads and executes without anyone asking it to.

02 · Telemetry you need

Sysmon EventID 12, 13 and 14 (registry key create/delete, value set, key rename) with TargetObject, Details and Image — Sysmon logs no registry activity unless the config explicitly includes these paths, so an empty result usually means the config, not the environment
Security 4657 (registry value modified) — requires Audit Registry and a SACL on each key you care about; without the SACL it produces nothing at all
Process creation for the writers: reg.exe, regedit.exe, PowerShell Set-ItemProperty and New-ItemProperty, and WMI StdRegProv
Sysmon EventID 11 (FileCreate) for the executable or DLL the value points at, which is usually written moments before
Autoruns-style periodic inventory of the same keys, as a backstop for hosts where registry auditing is not collected

03 · How the logic works

Every rule here is two halves: the key path says which persistence mechanism is in play, the value data says what will run. Matching only the path gives you every installer in the estate; matching the data — an executable under a user-writable directory such as AppData, ProgramData or Temp, a path with no directory at all, a scripting host, a base64 blob — is what makes it an alert. Two coverage traps are worth memorising. First, persistence exists in both hives: a rule scoped to HKLM misses every per-user Run key, and Sysmon reports the user hive as HKU\<SID>\... rather than HKCU, so a rule written with HKCU matches nothing. Second, the 32-bit view under Wow6432Node is a separate path. For the narrower mechanisms — an IFEO Debugger value, an appended LSA package, an AppInit DLL — the existence of the write is itself the signal and no data condition is needed, which makes them the quietest and best rules in the category.

04 · Common false positives

Application installers and updaters registering themselves at logon — Chrome and Edge update, Adobe, Dropbox, OneDrive and similar
Enterprise management and Group Policy preferences writing Run values across the fleet
Password-filter and credential-provider products that legitimately register LSA notification packages
Backup, EDR and disk-encryption agents registering COM servers and Winlogon components during install
Developer tooling setting IFEO values for debugging, and imaging or provisioning workflows that rewrite these keys wholesale

05 · Detection maturity

Tier 1 — starting point: Matches writes to the Run and RunOnce keys.
Tier 2 — tuned: Covers the full set of autostart keys across both hives and the 32-bit view, conditioned on the value data pointing somewhere user-writable, with known publishers excluded.
Tier 3 — correlated: Correlates the write with the creation of the file it points at, the process that performed the write, and how rare that value is across the fleet.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Alert on where the value points, not on the key being touched — the same Run key is written by every installer you own
Treat IFEO Debugger, GlobalFlag with silent-exit monitoring, AppInit_DLLs and LSA package changes as near-zero-volume rules and give them their own higher severity
Cover HKLM, the per-user hive as your telemetry actually spells it, and the Wow6432Node view in the same rule, then check the rule fires for all three
Exclude by the signature or full path of the writing process where the event carries it, rather than by the value name
Baseline what exists across the fleet — persistence that appears on one host and nowhere else is the finding

Declared by the author

Password filter and multi-factor authentication products being installed or upgraded. Their installers legitimately append a DLL name to Notification Packages, and a smartcard or federation agent does the same to Security Packages. MITRE's FileHashAllowList and ImagePathPattern knobs are aimed at this case — the value written names the DLL, so allowlist the specific package name your estate deploys rather than muting the key.
Entra ID join and Windows Hello for Business enrolment, which register the cloud authentication provider in Security Packages. It is one write per device, but a hybrid-join or WHfB rollout turns that into a fleet-wide burst over the days the enrolment wave runs.
Domain controller promotion and demotion, plus Credential Guard and RDP security feature changes, which rewrite the package lists as part of a supported Windows role or feature change.
Windows components registering LSA extensions under Control\LsaExtensionConfig — that arm matches the whole subtree, so any in-box provider written during setup, servicing or a feature update lands in the queue.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Verified in Siemphony lab

Security Datasets — Security Support Provider persistence
passed
Siemphony IR · 3 Sept 2026
1 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1547.008, T1547.005, T1556.002, evaluated against their registry_set events.

Share this rule

/u/siemphony/c8cb20b9-e191-40d5-8ce2-79b76b2ac644

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Registry write to an LSA package list or LSA extension key

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it