Cross-source coverage
T1556.002 / ATT&CK
Modify Authentication Process: Password Filter DLL
6 rules across 3 sources.
From MITRE ATT&CK 19.2
Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated.
Windows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as DLLs containing a method to validate potential passwords against password policies. Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts. Before registering new passwords in the Security Accounts Manager (SAM), the Local Security Authority (LSA) requests validation from each registered filter. Any potential changes cannot take effect until every registered filter acknowledges validation.
Adversaries can register malicious password filters to harvest credentials from local computers and/or entire domains. To perform proper validation, filters must receive plain-text credentials from the LSA. A malicious password filter would receive these plain-text credentials every time a password request is made.
- Tactics
- Defense Impairment · Persistence · Credential Access
- Platforms
- Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmon
How MITRE says to detect it DET0472
Detect Malicious Password Filter DLL Registration
Windows Analytic 1303
Detects suspicious registration of new password filter DLLs into the authentication process. Correlates registry modifications to LSASS Notification Packages with subsequent DLL creation and loading events. Observes anomalous file placement of DLLs in system directories followed by LSASS loading the new filter during logon/password change activity.
WinEventLog:SecurityEventCode=4657WinEventLog:SysmonEventCode=11WinEventLog:SysmonEventCode=7
SigmaHQ/sigma
3 rules| Detection | Severity | Format |
|---|---|---|
| Powershell Install a DLL in System Directory | High | Sigma |
| Dropping Of Password Filter DLL | Medium | Sigma |
| Potential Suspicious Activity Using SeCEdit | Medium | Sigma |
socfortress/Wazuh-Rules
2 rules| Detection | Severity | Format |
|---|---|---|
| T1556.002 - Password Filter DLL Registration detected: Modification of LSA Authentication Packages registry key. | High | Wazuh XML |
| T1556.002 - Password Filter DLL Registration detected: Modification of LSA Notification Packages registry key. | High | Wazuh XML |
elastic/protections-artifacts
1 rule| Detection | Severity | Format |
|---|---|---|
| Suspicious Windows Authentication Registry Modification | Undefined | Elastic TOML |