Windows LSASS Credential Theft via Registry Manipulation

This threat involves the abuse of undocumented Windows Registry keys, specifically within the NTDS service, to achieve code execution within the context of the Local Security Authority Subsystem Service (LSASS). By modifying the DirectoryServiceExtPt or LsaDbExtPt keys, an attacker can force the system to load a malicious DLL into the LSASS process. This technique is highly effective for credential theft as it grants the attacker direct access to the memory space where credentials and authentication tokens reside. This method is a known persistence and privilege escalation tactic often utilized by threat actors using post-exploitation toolsets like Mimikatz. Given the critical nature of LSASS, unauthorized modifications to these registry paths should be treated as a significant security incident indicating a high probability of compromise and sensitive data exfiltration.

Attack Chain

1. Attacker gains initial access to the target Windows system via spearphishing or exploit.
2. Attacker executes a payload with administrative or SYSTEM privileges required to modify the registry.
3. Attacker identifies the target registry keys: HKLM\SYSTEM\CurrentControlSet\Services\NTDS\DirectoryServiceExtPt or LsaDbExtPt.
4. Attacker writes the path of a malicious DLL to the value of the identified registry key.
5. The NTDS service or a system restart triggers the loading of the defined DLL into the lsass.exe process.
6. The malicious DLL executes within the LSASS process space.
7. Attacker hooks authentication functions or reads memory to extract credentials (e.g., cleartext passwords, NTLM hashes, Kerberos tickets).
8. Credentials are exfiltrated to the attacker's C2 server for lateral movement.

Impact

Successful exploitation of this mechanism results in total compromise of credentials cached on the local machine. This exposure allows for rapid lateral movement across the domain, unauthorized access to sensitive accounts, and potential escalation to domain administrator privileges. The impact is critical, as it bypasses traditional security controls by operating within a core Windows service process.

Recommendation

• Deploy the Sigma rule below to detect unauthorized modifications to the identified registry keys.
• Enable Sysmon Event ID 13 (RegistryValue-Set) across all domain controllers and high-value workstations.
• Monitor for unsigned, non-standard DLL loads into lsass.exe using EDR telemetry.
• Investigate any process modifying keys under \CurrentControlSet\Services\NTDS\ that does not correlate with known administrative software update activity.