adpare
59 lines
3.1 KiB
JSON
59 lines
3.1 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--22923220-20d6-48b4-8ac3-f86f6c89721a",
|
|
"spec_version": "2.0",
|
|
"objects": [
|
|
{
|
|
"type": "attack-pattern",
|
|
"id": "attack-pattern--52d40641-c480-4ad5-81a3-c80ccaddf82d",
|
|
"created": "2017-05-31T21:31:43.135Z",
|
|
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"revoked": true,
|
|
"external_references": [
|
|
{
|
|
"source_name": "mitre-attack",
|
|
"url": "https://attack.mitre.org/techniques/T1131",
|
|
"external_id": "T1131"
|
|
},
|
|
{
|
|
"source_name": "MSDN Authentication Packages",
|
|
"description": "Microsoft. (n.d.). Authentication Packages. Retrieved March 1, 2017.",
|
|
"url": "https://msdn.microsoft.com/library/windows/desktop/aa374733.aspx"
|
|
},
|
|
{
|
|
"source_name": "Graeber 2014",
|
|
"description": "Graeber, M. (2014, October). Analysis of Malicious Security Support Provider DLLs. Retrieved March 1, 2017.",
|
|
"url": "http://docplayer.net/20839173-Analysis-of-malicious-security-support-provider-dlls.html"
|
|
},
|
|
{
|
|
"source_name": "Microsoft Configure LSA",
|
|
"description": "Microsoft. (2013, July 31). Configuring Additional LSA Protection. Retrieved June 24, 2015.",
|
|
"url": "https://technet.microsoft.com/en-us/library/dn408187.aspx"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
|
|
],
|
|
"modified": "2025-10-24T17:48:47.390Z",
|
|
"name": "Authentication Package",
|
|
"description": "Windows Authentication Package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system. (Citation: MSDN Authentication Packages)\n\nAdversaries can use the autostart mechanism provided by LSA Authentication Packages for persistence by placing a reference to a binary in the Windows Registry location <code>HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\</code> with the key value of <code>\"Authentication Packages\"=<target binary></code>. The binary will then be executed by the system when the authentication packages are loaded.",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "mitre-attack",
|
|
"phase_name": "persistence"
|
|
}
|
|
],
|
|
"x_mitre_attack_spec_version": "3.2.0",
|
|
"x_mitre_deprecated": false,
|
|
"x_mitre_domains": [
|
|
"enterprise-attack"
|
|
],
|
|
"x_mitre_is_subtechnique": false,
|
|
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"x_mitre_platforms": [
|
|
"Windows"
|
|
],
|
|
"x_mitre_version": "1.1"
|
|
}
|
|
]
|
|
} |