T1547.008: LSASS Driver
Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.[1]
Adversaries may target LSASS drivers to obtain persistence. By either replacing or adding illegitimate drivers (e.g., Hijack Execution Flow), an adversary can use LSA operations to continuously execute malicious payloads.
Analyst context for executives and security teams
LSASS Driver matters because it targets Windows authentication infrastructure for persistence and privilege escalation. If an attacker can add or replace code loaded by LSASS, malicious payloads may run inside a highly trusted security process, making the compromise harder to remove and more relevant to identity assurance, incident containment, and endpoint hardening decisions.
Executive priority
Treat this as a high-value Windows control validation item, not just a malware behavior. Leaders should ask whether critical Windows systems have protections for privileged authentication processes, whether unauthorized LSA/LSASS plugin changes would be noticed, and whether incident responders can verify persistence in LSASS-related components during containment. This technique is especially relevant to resilience because it affects authentication trust and may survive normal user-session cleanup.
Technical view
This is a Windows sub-technique of Boot or Logon Autostart Execution under persistence and privilege escalation. ATT&CK does not provide official detection text, but the relationship to DET0225 points defenders toward detecting unauthorized LSASS driver persistence via LSA plugin abuse. SOC and IR teams should validate visibility into LSASS-related DLL or driver additions, replacements, and load behavior; compare observed components against trusted baselines; and review whether privileged process integrity controls such as Windows RunAsPPL are enabled where appropriate.
Likely telemetry
- Windows endpoint configuration and autostart inventory for LSA/LSASS-related loading locations
- File creation, replacement, and integrity monitoring for DLLs or drivers associated with LSASS security functions
- Process/module load telemetry showing libraries loaded into lsass.exe
- Endpoint security or EDR telemetry for tampering with highly privileged authentication processes
- Configuration evidence for privileged process integrity controls such as RunAsPPL
Detection direction
- Build or validate detections for unauthorized LSASS driver or LSA plugin persistence, aligned to DET0225.
- Baseline legitimate LSASS-related components and alert on additions, replacements, or unexpected library loads into lsass.exe.
- Tune carefully for legitimate security software and Windows components that interact with authentication processes to reduce false positives.
- Do not rely only on process execution alerts; this behavior may appear as persistence through trusted LSASS loading paths.
- During IR, include LSASS-related persistence checks when investigating Windows privilege escalation or durable endpoint compromise.
Mitigation priorities
- Prioritize Privileged Process Integrity controls for authentication processes, including evaluating RunAsPPL on Windows systems where supported.
- Apply Credential Access Protection practices that restrict access to credential-related mechanisms and harden authentication process exposure.
- Restrict library loading so only trusted and verified libraries can be loaded by sensitive processes.
- Maintain trusted baselines for LSASS-related components and review deviations through change control.
- Use autorun and persistence inventory during hardening and incident response to confirm that unauthorized LSASS-related entries are absent.
Analyst notes and limits
The object is a Windows enterprise ATT&CK sub-technique, previously represented by revoked technique T1177, and is now T1547.008 under Boot or Logon Autostart Execution. ATT&CK relationships show use by Wingbird and Pasam, and mitigations M1025, M1043, and M1044. The business relevance is strongest where Windows authentication integrity, privileged process hardening, and endpoint persistence assurance are audit or resilience priorities.
MITRE provides no official detection text for this object in the supplied fields. Specific registry paths, event IDs, vendor detections, and confirmed environmental exposure are not included here and should be validated locally before making coverage claims.
LSASS Driver
Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.[1]
Adversaries may target LSASS drivers to obtain persistence. By either replacing or adding illegitimate drivers (e.g., Hijack Execution Flow), an adversary can use LSA operations to continuously execute malicious payloads.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1547 | Boot or Logon Autostart Execution | This object subtechnique of Boot or Logon Autostart Execution. |
| Enterprise | T1177 | LSASS Driver | LSASS Driver revoked by this object. |
Groups, software, and campaigns
S0176: Wingbird
S0208: Pasam
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | 1723cf775e93… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Microsoft Security Subsystem
Microsoft. (n.d.). Security Subsystem Architecture. Retrieved November 27, 2017.
Open source URL -
[2]
Microsoft DLL Security
Microsoft. (n.d.). Dynamic-Link Library Security. Retrieved November 27, 2017.
Open source URL -
[3]
Microsoft LSA Protection Mar 2014
Microsoft. (2014, March 12). Configuring Additional LSA Protection. Retrieved November 27, 2017.
Open source URL -
[4]
TechNet Autoruns
Russinovich, M. (2016, January 4). Autoruns for Windows v13.51. Retrieved June 6, 2016.
Open source URL -
[5]
mitre-attack T1547.008Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.