Detect Password Filter DLL in Google Chronicle
Adversaries may register malicious password filter DLLs to harvest credentials as they are validated. Windows password filters are DLLs that implement password policy enforcement — the LSA calls each registered filter with plaintext credentials before accepting a password change. A malicious filter receives plaintext passwords every time any user changes their password. Threat groups Strider (ProjectSauron/Remsec) and OilRig have deployed this technique against domain controllers.
MITRE ATT&CK
- Technique
- T1556 Modify Authentication Process
- Sub-technique
- T1556.002 Password Filter DLL
- Canonical reference
- https://attack.mitre.org/techniques/T1556/002/
YARA-L Detection Query
rule t1556_002_password_filter_dll_registration {
meta:
author = "Detection Engineering"
description = "Detects registration of a Password Filter DLL via modification of the Windows LSA Notification Packages registry key (T1556.002). Malicious filters receive plaintext credentials on every domain password change. Associated with Strider/ProjectSauron and OilRig threat actors targeting domain controllers."
mitre_attack_tactic = "Credential Access"
mitre_attack_technique = "T1556.002"
mitre_attack_technique_name = "Modify Authentication Process: Password Filter DLL"
severity = "CRITICAL"
confidence = "HIGH"
platform = "Windows"
data_source = "Sysmon, Windows Endpoint"
version = "1.0"
events:
$e.metadata.event_type = "REGISTRY_MODIFICATION"
re.regex($e.target.registry.registry_key,
`(?i)\\(CurrentControlSet|ControlSet001|ControlSet002)\\Control\\Lsa`)
$e.target.registry.registry_value_name = "Notification Packages"
$e.principal.hostname = $hostname
condition:
$e
}Chronicle YARA-L 2.0 rule detecting modification of the Windows LSA Notification Packages registry key — the definitive mechanism for registering Password Filter DLLs. Targets the registry-write phase of T1556.002. A companion rule for DLL file creation in System32 by non-installer processes is recommended for full technique coverage.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate enterprise password filter software installations (nFront, Enzoic, SpecOps) adding their DLL name to Notification Packages on domain controllers — validate by comparing the added DLL name against known vendor DLL names and verifying digital signature
- Domain administrator configuration scripts or GPO enforcement that explicitly sets Notification Packages to a known-good list — fires on every enforcement action even when the content is net-unchanged
- Third-party identity security platforms (CyberArk, SailPoint, Saviynt) that register credential hook DLLs during agent installation or update cycles on privileged hosts
Other platforms for T1556.002
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Register a Benign Password Filter DLL
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject=HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages, Details containing 'TestPasswordFilter'. Security Event ID 4657 (registry value modified) if object access auditing is enabled.
- Test 2Drop a DLL File in System32 from Non-System Process
Expected signal: Sysmon Event ID 11 (File Create): TargetFilename=C:\Windows\System32\testpwdfilter.dll, Image=cmd.exe or powershell.exe. Security Event ID 4663 if file system auditing is enabled.
- Test 3Query Current LSA Notification Packages (Reconnaissance)
Expected signal: Security Event ID 4656/4663 (registry key access) if object access auditing is enabled. Sysmon Event ID 12 (Registry Key Opened) for HKLM\SYSTEM\CurrentControlSet\Control\Lsa.
References (6)
- https://attack.mitre.org/techniques/T1556/002/
- http://carnal0wnage.attackresearch.com/2013/09/stealing-passwords-every-time-they.html
- https://clymb3r.wordpress.com/2013/09/15/intercepting-password-changes-with-function-hooking/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1556.002/T1556.002.md
- https://docs.microsoft.com/en-us/windows/win32/secauthn/password-filter-programming-considerations
- https://www.secureworks.com/research/skeleton-key-malware-analysis
Unlock Pro Content
Get the full detection package for T1556.002 including response playbook, investigation guide, and atomic red team tests.