value:  Wingbird drops a malicious file (sspisrv.dll) alongside a copy of lsass.exe which is used to register a service that loads sspisrv.dll as a driver. The payload of the malicious driver (located in its entry-point function) is executed when loaded by lsass.exe before the spoofed service becomes unstable and crashes.
name: Boot or Logon Autostart Execution: Lsass Driver