LSA Packages
DLLs the LSA loads as authentication, security or notification packages.
Use it to find an extra DLL loaded into LSA, such as a password filter that sees passwords as they are set.
- SYSTEM
- Persistence
What It Is
The Local Security Authority, or LSA, is the Windows component that handles signing in and security. It loads DLLs listed under the Control\Lsa key in HKLM SYSTEM as authentication, security or notification packages, using configuration in the registry. Authentication packages such as MSV1_0 check sign-in data, and the Security Packages value lists security support providers. A Notification Packages value lists password filter DLLs that the LSA calls when a password changes.
What It Proves
A DLL named in Authentication Packages, Security Packages or Notification Packages is loaded into the LSA process, which runs as SYSTEM and handles credentials. A password filter in Notification Packages sees passwords in clear as they are set.
What It Does Not Prove
These values hold genuine Windows packages, so you are looking for an extra or odd DLL. A change usually needs a reboot to take effect.
Where It Lives
LSA Packages lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| Notification Packages holds only scecli, the default. Any added name could be a password filter, so find its DLL in System32 and hash it. |
| Security Packages holds only an empty string, the Windows 11 default, so no extra provider is listed. A name added here would load into LSA at the next boot. |
| Authentication Packages is the default msv1_ |
How to Read It
Read Authentication Packages, Security Packages and Notification Packages under Lsa, and OSConfig Security Packages. Each entry is a DLL name resolved from System32. A path or an unknown name is the red flag. A new Notification Packages entry can be a password filter, so treat it as credential theft.
- When Windows Writes It
- When a package value is changed, usually with admin rights, taking effect at reboot.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Autoruns, Registry Explorer, RECmd
Hunt It
Defender records these writes within retention and keeps the previous data, so an added package is clear. LSA reads these lists at boot, so a hit does not prove the DLL has loaded.
// Changes to the LSA package listsDeviceRegistryEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what LSA Packages shows.
- DLL Load Into lsass, Sysmon Event 7Not in the RegistryShows the package DLL loading into lsass.exe, after the reboot it needs.
Sources
The facts on this page come from these public pages, which say more on each point.
- MITRE ATT&CK T1547.002: Boot or Logon Autostart Execution: Authentication Package (opens in a new tab)
- MITRE ATT&CK T1547.005: Boot or Logon Autostart Execution: Security Support Provider (opens in a new tab)
- MITRE ATT&CK T1556.002: Modify Authentication Process: Password Filter DLL (opens in a new tab)