DLL Load via LSASS Registry Key Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•35

This rule detects attempts to load malicious DLLs into the LSASS process by modifying undocumented registry keys. Specifically, it looks for modifications to 'DirectoryServiceExtPt' or 'LsaDbExtPt' registry keys that are not associated with the legitimate 'ntdsa.dll' or 'lsadb.dll' files, which are typically loaded by 'lsass.exe' on domain controllers. This technique can be used for privilege escalation, persistence, and credential access.