Detect Modify Authentication Process in CrowdStrike LogScale
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on macOS systems. By modifying an authentication process, an adversary may authenticate to a service or system without using valid accounts, or may passively harvest credentials as users authenticate. Techniques include registering malicious password filter DLLs that receive plaintext passwords during every password change, injecting security support providers (SSPs) into LSASS to intercept credentials, installing skeleton keys to accept any password for domain accounts, modifying PAM stack configuration files to permit unauthorized access, and replacing legitimate authentication binaries with trojanized versions that exfiltrate credentials.
MITRE ATT&CK
- Technique
- T1556 Modify Authentication Process
- Canonical reference
- https://attack.mitre.org/techniques/T1556/
LogScale Detection Query
// T1556 - Modify Authentication Process
// Branch 1: LSA registry ASEP modifications (Sysmon EventCode 13 equivalent)
// Branch 2: Unexpected DLL loads by lsass.exe (Sysmon EventCode 7 equivalent)
(#event_simpleName = "AsepValueUpdate" OR #event_simpleName = "ClassicImageLoad")
| case {
#event_simpleName = "AsepValueUpdate" |
RegistryPath = /(?i)(\\Control\\Lsa\\Notification Packages|\\Control\\Lsa\\Security Packages|\\Control\\Lsa\\Authentication Packages|\\Control\\Lsa\\OSConfig|\\Control\\NetworkProvider\\Order|\\Winlogon\\GinaDLL|\\Authentication\\Credential Providers)/ |
ImageFileName != /(?i)(TrustedInstaller\.exe|MsMpEng\.exe|msiexec\.exe|wuauclt\.exe|WindowsUpdateAgent\.exe)/ |
DetectionType := "LSA Registry Modification" ;
#event_simpleName = "ClassicImageLoad" |
TargetProcessFileName = /(?i)[/\\]lsass\.exe$/ |
ImageFileName != /(?i)(ntdll\.dll|kernel32\.dll|kernelbase\.dll|msvcrt\.dll|kerberos\.dll|msv1_0\.dll|wdigest\.dll|tspkg\.dll|pku2u\.dll|cloudap\.dll|schannel\.dll|cryptdll\.dll|samsrv\.dll|lsasrv\.dll|netlogon\.dll|ntlmshared\.dll|rassfm\.dll)$/ |
DetectionType := "Unexpected DLL Load by LSASS" ;
* | drop()
}
| table(
[timestamp, ComputerName, UserName, DetectionType,
RegistryPath, RegistryValueData, ImageFileName,
TargetProcessFileName, CommandLine, SHA256HashData]
)
| sort(field=timestamp, order=desc)CrowdStrike LogScale (Humio) detection for T1556 using Falcon Insight XDR telemetry. Uses AsepValueUpdate events — Falcon's normalized ASEP registry change event type — to detect LSA authentication key modifications across all CurrentControlSet paths, and ClassicImageLoad events to identify unexpected DLLs loaded into lsass.exe. Combines both branches via a case statement with drop() to suppress non-matching events. The AsepValueUpdate event type covers all HKLM SYSTEM registry writes to known persistence locations. Requires Falcon Prevent or Falcon Insight XDR for module load telemetry; SHA256HashData field enables immediate VirusTotal enrichment.
Data Sources
Required Tables
False Positives & Tuning
- CrowdStrike Falcon sensor itself or Falcon Complete managed response operations performing ASEP modifications during sensor update cycles — these appear as AsepValueUpdate events from CrowdStrike-signed processes and can be filtered by SHA256HashData against CrowdStrike's known-good hash list
- Windows in-place feature updates (e.g., 22H2 to 23H2) modifying authentication packages during the OS upgrade phase — generates a burst of legitimate ASEP changes from TrustedInstaller that coincide with the upgrade window
- Third-party PAM solutions (BeyondTrust Password Safe, CyberArk Endpoint Privilege Manager, Delinea Secret Server) registering credential provider DLLs on managed endpoints during agent deployment — identifiable by consistent software-deployment parent process chains
Other platforms for T1556
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Register Benign Password Filter DLL in LSA Notification Packages
Expected signal: Sysmon Event ID 13: TargetObject=HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages, Details contains 'df00tech-test-filter', Image=powershell.exe. Windows Security Event ID 4657 if SACL is configured on the LSA key. DeviceRegistryEvents in MDE: RegistryKey contains 'Notification Packages', RegistryValueData contains new DLL name, InitiatingProcessFileName=powershell.exe.
- Test 2Register Fake Security Support Provider (SSP) in LSA Security Packages
Expected signal: Sysmon Event ID 13: TargetObject=HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages, Details appended with 'df00tech-test-ssp'. DeviceRegistryEvents: RegistryKey contains 'Security Packages', ActionType=RegistryValueSet. If system reboots, Security Event ID 4610 will fire listing the (missing) SSP DLL name — LSASS will generate an error in System event log.
- Test 3Modify PAM Configuration to Permit Authentication Bypass on Linux
Expected signal: Linux auditd: syscall=openat/write on path=/etc/pam.d/sshd with auid=<attacker_uid> if auditd watches are configured (-w /etc/pam.d/ -p wa -k pam_modification). Syslog: process writing to /etc/pam.d/sshd. File integrity monitoring (AIDE, Tripwire) will alert on hash change to /etc/pam.d/sshd. DeviceFileEvents (for Linux onboarded to MDE): FileModified on /etc/pam.d/sshd.
- Test 4Register Malicious Network Provider DLL via Registry
Expected signal: Sysmon Event ID 13: TargetObject=HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ProviderOrder, Image=powershell.exe, Details contains appended provider name. DeviceRegistryEvents: RegistryKey contains 'NetworkProvider\Order', RegistryValueName='ProviderOrder', ActionType=RegistryValueSet.
References (9)
- https://attack.mitre.org/techniques/T1556/
- https://clymb3r.wordpress.com/2013/09/15/intercepting-password-changes-with-function-hooking/
- https://xorrior.com/persistent-credential-theft/
- https://www.secureworks.com/research/skeleton-key-malware-analysis
- https://adsecurity.org/?p=2053
- https://technet.microsoft.com/en-us/library/dn487457.aspx
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1556/T1556.md
- https://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_lsa_packages.yml
Unlock Pro Content
Get the full detection package for T1556 including response playbook, investigation guide, and atomic red team tests.
Related Detections
Sub-techniques (9)
- T1556.001Domain Controller Authentication
- T1556.002Password Filter DLL
- T1556.003Pluggable Authentication Modules
- T1556.004Network Device Authentication
- T1556.005Reversible Encryption
- T1556.006Multi-Factor Authentication
- T1556.007Hybrid Identity
- T1556.008Network Provider DLL
- T1556.009Conditional Access Policies