LSASS Loading Suspicious DLL

The Local Security Authority Subsystem Service (LSASS) is a critical Windows component that manages security policies and user authentication. Attackers often target LSASS to dump credentials, using techniques like injecting malicious DLLs. This detection focuses on identifying instances where LSASS loads a DLL that is either unsigned or not signed by a trusted vendor. The rule excludes known legitimate signatures and file hashes to reduce false positives. This activity is a strong indicator of credential access attempts, potentially leading to further compromise of the system and network. The signatures identified in the rule contain well-known software vendors like Microsoft, McAfee and Citrix.

Attack Chain

1. An attacker gains initial access to the system through various means (e.g., phishing, exploiting a vulnerability).
2. The attacker elevates privileges to gain sufficient access to interact with the LSASS process.
3. The attacker drops a malicious DLL onto the system, often disguised as a legitimate file.
4. The attacker injects the malicious DLL into the LSASS process using techniques like Reflective DLL Injection.
5. LSASS loads the injected DLL, granting the attacker access to sensitive credentials stored in memory.
6. The malicious DLL dumps credentials, such as plaintext passwords or NTLM hashes.
7. The attacker uses the stolen credentials for lateral movement to other systems on the network.
8. The attacker achieves their final objective, such as data exfiltration or deploying ransomware.

Impact

Successful exploitation leads to credential compromise, allowing attackers to move laterally within the network, access sensitive data, and potentially achieve complete domain dominance. This can result in data breaches, financial losses, and reputational damage. The impact depends on the level of access associated with the compromised credentials.

Recommendation

• Deploy the LSASS Loading Untrusted DLL Sigma rule to your SIEM to detect suspicious DLLs loaded by LSASS.
• Investigate any alerts generated by the Sigma rule and review the loaded DLL’s code signature and hash.
• Block the identified SHA256 hashes listed in the IOC table to prevent the execution of known malicious DLLs.
• Implement application whitelisting to restrict which DLLs can be loaded into LSASS.
• Enable Sysmon process creation and image load logging to provide the necessary data for detection.