Esc

LSASS Driver - T1547.008

(ATT&CK® Technique)

Definition

Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.

D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.

        graph LR;

     T1547008["LSASS Driver"] --> |modifies| SystemServiceSoftware["System Service Software"]; class T1547008 OffensiveTechniqueNode;
        class SystemServiceSoftware ArtifactNode; click SystemServiceSoftware href "/dao/artifact/d3f:SystemServiceSoftware";
        click T1547008 href "/offensive-technique/attack/T1547.008/"; click SystemServiceSoftware href "/dao/artifact/d3f:SystemServiceSoftware"; T1547008["LSASS Driver"] --> |may-create| SharedLibraryFile["Shared Library File"]; class T1547008 OffensiveTechniqueNode;
        class SharedLibraryFile ArtifactNode; click SharedLibraryFile href "/dao/artifact/d3f:SharedLibraryFile";
        click T1547008 href "/offensive-technique/attack/T1547.008/"; click SharedLibraryFile href "/dao/artifact/d3f:SharedLibraryFile";                          DecoyFile["Decoy File"] -->
          | spoofs | SharedLibraryFile["Shared Library File"];

          DecoyFile["Decoy File"] -.->
            | may-deceive | T1547008["LSASS Driver"] ;
          class DecoyFile DefensiveTechniqueNode;
          class SharedLibraryFile ArtifactNode;
          click DecoyFile href "/technique/d3f:DecoyFile"; FileIntegrityMonitoring["File Integrity Monitoring"] -->
          | analyzes | SharedLibraryFile["Shared Library File"];

          FileIntegrityMonitoring["File Integrity Monitoring"] -.->
            | may-detect | T1547008["LSASS Driver"] ;
          class FileIntegrityMonitoring DefensiveTechniqueNode;
          class SharedLibraryFile ArtifactNode;
          click FileIntegrityMonitoring href "/technique/d3f:FileIntegrityMonitoring";                           FileEviction["File Eviction"] -->
          | deletes | SharedLibraryFile["Shared Library File"];

          FileEviction["File Eviction"] -.->
            | may-evict | T1547008["LSASS Driver"] ;
          class FileEviction DefensiveTechniqueNode;
          class SharedLibraryFile ArtifactNode;
          click FileEviction href "/technique/d3f:FileEviction"; SoftwareUpdate["Software Update"] -->
          | updates | SystemServiceSoftware["System Service Software"];

          SoftwareUpdate["Software Update"] -.->
            | may-harden | T1547008["LSASS Driver"] ;
          class SoftwareUpdate DefensiveTechniqueNode;
          class SystemServiceSoftware ArtifactNode;
          click SoftwareUpdate href "/technique/d3f:SoftwareUpdate"; FileEncryption["File Encryption"] -->
          | encrypts | SharedLibraryFile["Shared Library File"];

          FileEncryption["File Encryption"] -.->
            | may-harden | T1547008["LSASS Driver"] ;
          class FileEncryption DefensiveTechniqueNode;
          class SharedLibraryFile ArtifactNode;
          click FileEncryption href "/technique/d3f:FileEncryption";                                        LocalFilePermissions["Local File Permissions"] -->
          | restricts | SharedLibraryFile["Shared Library File"];

          LocalFilePermissions["Local File Permissions"] -.->
            | may-isolate | T1547008["LSASS Driver"] ;
          class LocalFilePermissions DefensiveTechniqueNode;
          class SharedLibraryFile ArtifactNode;
          click LocalFilePermissions href "/technique/d3f:LocalFilePermissions"; FileAnalysis["File Analysis"] -->
          | analyzes | SharedLibraryFile["Shared Library File"];

          FileAnalysis["File Analysis"] -.->
            | may-detect | T1547008["LSASS Driver"] ;
          class FileAnalysis DefensiveTechniqueNode;
          class SharedLibraryFile ArtifactNode;
          click FileAnalysis href "/technique/d3f:FileAnalysis";                           RestoreSoftware["Restore Software"] -->
          | restores | SystemServiceSoftware["System Service Software"];

          RestoreSoftware["Restore Software"] -.->
            | may-restore | T1547008["LSASS Driver"] ;
          class RestoreSoftware DefensiveTechniqueNode;
          class SystemServiceSoftware ArtifactNode;
          click RestoreSoftware href "/technique/d3f:RestoreSoftware"; RestoreFile["Restore File"] -->
          | restores | SharedLibraryFile["Shared Library File"];

          RestoreFile["Restore File"] -.->
            | may-restore | T1547008["LSASS Driver"] ;
          class RestoreFile DefensiveTechniqueNode;
          class SharedLibraryFile ArtifactNode;
          click RestoreFile href "/technique/d3f:RestoreFile";                                                       RemoteFileAccessMediation["Remote File Access Mediation"] -->
          | isolates | SharedLibraryFile["Shared Library File"];

          RemoteFileAccessMediation["Remote File Access Mediation"] -.->
            | may-isolate | T1547008["LSASS Driver"] ;
          class RemoteFileAccessMediation DefensiveTechniqueNode;
          class SharedLibraryFile ArtifactNode;
          click RemoteFileAccessMediation href "/technique/d3f:RemoteFileAccessMediation";

json