Custom LSA Security Package Registration in LSASS

Kaung Khant Ko@kaungkhantko

•updated yesterday•4•0•8

Detects the loading of an unsigned or non-standard DLL into the Local Security Authority Subsystem Service (LSASS) process, correlated with the same device registering that DLL as a Security Package or Authentication Package via the Windows Registry or API.