LSASS Driver DLL Registered for Persistence

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects network traffic on port 445 (SMB) containing the strings "LSASS" and "AddDll" (case-insensitive). This combination of strings suggests an attempt to register a malicious DLL with the Local Security Authority Subsystem Service (LSASS) for persistence, a technique often used by malware to maintain access on a compromised system. The flow is set to 'to_server' and 'established', indicating an outgoing connection from the monitored network to a server, and that the TCP connection has been successfully established.