T1556.001 — Domain Controller Authentication

Tactics: Defense Impairment, Persistence, Credential Access · Platforms: Windows

Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts. Malware may be used to inject false credentials into the authentication process on a domain controller with the intent of creating a backdoor used…

Sub-technique of Modify Authentication Process (T1556).

Sigma detection rules (1)

T1556.001 Modify Authentication Process: Domain Controller Authentication

title: "T1556.001 Modify Authentication Process: Domain Controller Authentication"
id: b87c71f4-542f-4355-9080-5c44210df9fe
description: 'Detects processes opening lsass.exe with memory read/write rights consistent with Skeleton Key-style patching. (Data Component: Process Access; baseline tier: windows-eventid.) Tune using: MonitoredDLLs, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1556/001
author: Shahrukh Khan
date: 2026-04-06
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.001

logsource:
  category: process_access
  product: windows
  service: sysmon

detection:
  selection_lsass:
    EventID: '10'
    TargetImage|endswith: '\lsass.exe'
  selection_access_mask:
    GrantedAccess:
      - '0x1010'
      - '0x1038'
      - '0x40'
      - '0x1400'
      - '0x1F0FFF'
      - '0x1F1FFF'
      - '0x1F2FFF'
      - '0x1F3FFF'
      - '0x1FFFFF'
  filter_known_tools:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\dllhost.exe'
  condition: selection_lsass and selection_access_mask and not filter_known_tools

falsepositives:
  - Endpoint protection/EDR or debugging tools opening lsass.exe with elevated access.

level: medium

Related sub-techniques

Explore