LSASS Driver

Detect unauthorized LSASS driver persistence via LSA plugin abuse (Windows)

Privileged Process Integrity: Privileged Process Integrity focuses on defending highly privileged processes (e.g., system services, antivirus, or authentication processes) from tampering, injection, or compromise by adversaries. These processes often interact with critical components, making them prime targets for techniques like code injection, privilege escalation, and process manipulation. This mitigation can be implemented through the following measures:

Protected Process Mechanisms:

• Enable RunAsPPL on Windows systems to protect LSASS and other critical processes.
• Use registry modifications to enforce protected process settings: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL

Anti-Injection and Memory Protection:

• Enable Control Flow Guard (CFG), DEP, and ASLR to protect against process memory tampering.
• Deploy endpoint protection tools that actively block process injection attempts.

Code Signing Validation:

• Implement policies for Windows Defender Application Control (WDAC) or AppLocker to enforce execution of signed binaries.
• Ensure critical processes are signed with valid certificates.

Access Controls:

• Use DACLs and MIC to limit which users and processes can interact with privileged processes.
• Disable unnecessary debugging capabilities for high-privileged processes.

Kernel-Level Protections:

• Ensure Kernel Patch Protection (PatchGuard) is enabled on Windows systems.
• Leverage SELinux or AppArmor on Linux to enforce kernel-level security policies.

Tools for Implementation

Protected Process Light (PPL):

• RunAsPPL (Windows)
• Windows Defender Credential Guard

Code Integrity and Signing:

• Windows Defender Application Control (WDAC)
• AppLocker
• SELinux/AppArmor (Linux)

Memory Protection:

• Control Flow Guard (CFG), Data Execution Prevention (DEP), ASLR

Process Isolation/Sandboxing:

• Firejail (Linux Sandbox)
• Windows Sandbox
• QEMU/KVM-based isolation

Kernel Protection:

• PatchGuard (Windows Kernel Patch Protection)
• SELinux (Mandatory Access Control for Linux)
• AppArmor

Credential Access Protection: Credential Access Protection focuses on implementing measures to prevent adversaries from obtaining credentials, such as passwords, hashes, tokens, or keys, that could be used for unauthorized access. This involves restricting access to credential storage mechanisms, hardening configurations to block credential dumping methods, and using monitoring tools to detect suspicious credential-related activity. This mitigation can be implemented through the following measures:

Restrict Access to Credential Storage:

• Use Case: Prevent adversaries from accessing the SAM (Security Account Manager) database on Windows systems.
• Implementation: Enforce least privilege principles and restrict administrative access to credential stores such as C:\Windows\System32\config\SAM.

Use Credential Guard:

• Use Case: Isolate LSASS (Local Security Authority Subsystem Service) memory to prevent credential dumping.
• Implementation: Enable Windows Defender Credential Guard on enterprise endpoints to isolate secrets and protect them from unauthorized access.

Monitor for Credential Dumping Tools:

• Use Case: Detect and block known tools like Mimikatz or Windows Credential Editor.
• Implementation: Flag suspicious process behavior related to credential dumping.

Disable Cached Credentials:

• Use Case: Prevent adversaries from exploiting cached credentials on endpoints.
• Implementation: Configure group policy to reduce or eliminate the use of cached credentials (e.g., set Interactive logon: Number of previous logons to cache to 0).

Enable Secure Boot and Memory Protections:

• Use Case: Prevent memory-based attacks used to extract credentials.
• Implementation: Configure Secure Boot and enforce hardware-based security features like DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization).

Restrict Library Loading: Restricting library loading involves implementing security controls to ensure that only trusted and verified libraries (DLLs, shared objects, etc.) are loaded into processes. Adversaries often abuse Dynamic-Link Library (DLL) Injection, DLL Search Order Hijacking, or LD_PRELOAD mechanisms to execute malicious code by forcing the operating system to load untrusted libraries. This mitigation can be implemented through the following measures:

Enforce Safe Library Loading Practices:

• Enable SafeDLLSearchMode on Windows.
• Restrict LD_PRELOAD and LD_LIBRARY_PATH usage on Linux systems.

Code Signing Enforcement:

• Require digital signatures for all libraries loaded into processes.
• Use tools like Signtool, and WDAC to enforce signed DLL execution.

Environment Hardening:

• Secure library paths and directories to prevent adversaries from placing rogue libraries.
• Monitor user-writable directories and system configurations for unauthorized changes.

Audit and Monitor Library Loading:

• Enable Sysmon on Windows to monitor for suspicious library loads.
• Use auditd on Linux to monitor shared library paths and configuration file changes.

Use Application Control Solutions:

• Implement AppLocker, WDAC, or SELinux to allow only trusted libraries.

Tools for Implementation

Windows-Specific Tools:

• AppLocker: Application whitelisting for DLLs.
• Windows Defender Application Control (WDAC): Restrict unauthorized library execution.
• Signtool: Verify and enforce code signing.
• Sysmon: Monitor DLL load events (Event ID 7).

Linux-Specific Tools:

• auditd: Monitor changes to library paths and critical files.
• SELinux/AppArmor: Define policies to restrict library loading.
• ldconfig and chattr: Secure LD configuration files and prevent unauthorized modifications.

Cross-Platform Solutions:

• Wazuh or OSSEC: File integrity monitoring for library changes.
• Tripwire: Detect and alert on unauthorized library modifications.