T1547.002 — Authentication Package

Tactics: Persistence, Privilege Escalation · Platforms: Windows

Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating…

Sub-technique of Boot or Logon Autostart Execution (T1547).

Sigma detection rules (1)

T1547.002 Boot or Logon Autostart Execution: Authentication Package

title: "T1547.002 Boot or Logon Autostart Execution: Authentication Package"
id: ecbc02b5-f1e9-4bf7-8aee-40d7a84d1782
description: 'Detect LSA Authentication Package Persistence via Registry Modification of Control\Lsa\Authentication Packages. (Data Component: Module Load; baseline tier: windows-eventid.) Tune using: TimeWindow, ImageSignatureStatus, RegistryPathScope, UserContext, ParentProcess.'
references:
  - https://attack.mitre.org/techniques/T1547/002
author: Shahrukh Khan
date: 2026-01-13
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1547.002

logsource:
  category: registry_set
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '13'
    TargetObject|endswith:
      - '\Control\Lsa\Authentication Packages'
      - '\Control\Lsa\OSConfig\Authentication Packages'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Security software or LSA configuration tools legitimately registering additional authentication packages.

level: medium

Related sub-techniques

Explore