T1547.008 — LSASS Driver

Tactics: Persistence, Privilege Escalation · Platforms: Windows

Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local…

Sub-technique of Boot or Logon Autostart Execution (T1547).

Sigma detection rules (1)

T1547.008 Boot or Logon Autostart Execution: LSASS Driver

title: "T1547.008 Boot or Logon Autostart Execution: LSASS Driver"
id: f33cf312-c8e0-4e68-a013-3991abcae9b0
description: 'Detect unauthorized LSASS driver persistence via LSA plugin abuse. (Data Component: Driver Load; baseline tier: windows-eventid.) Tune using: TimeWindow, ImagePathPattern, SignatureValidation, RegistryKeyScope, FileHashAllowList.'
references:
  - https://attack.mitre.org/techniques/T1547/008
author: Shahrukh Khan
date: 2026-01-30
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1547.008

logsource:
  category: driver_load
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '6'
  filter_signed:
    Signed: 'true'
  condition: selection and not filter_signed

falsepositives:
  - Legitimate unsigned or test-signed third-party/OEM drivers on non-production systems.

level: medium

Related sub-techniques

Explore