当前位置：网站首页>[Red Team] ATT&CK - Self-starting - Self-starting mechanism using LSA authentication package

[Red Team] ATT&CK - Self-starting - Self-starting mechanism using LSA authentication package

2022-08-10 03:31:00 【Thousands of miles :)】

Technical Notes

An attacker could abuse the authentication package to execute DLLs at system startup.The Windows Authentication Pack DLL is loaded by the Local Security Authority (LSA) process at system startup.They provide support for the operating system's multiple login processes and multiple security protocols.

https://docs.microsoft.com/en-us/windows/win32/secauthn/lsa-authentication?redirectedfrom=MSDNhttps://docs.microsoft.com/en-us/windows/win32/secauthn/lsa-authentication?redirectedfrom=MSDN<