Detect Password Filter DLL in CrowdStrike LogScale
Adversaries may register malicious password filter DLLs to harvest credentials as they are validated. Windows password filters are DLLs that implement password policy enforcement — the LSA calls each registered filter with plaintext credentials before accepting a password change. A malicious filter receives plaintext passwords every time any user changes their password. Threat groups Strider (ProjectSauron/Remsec) and OilRig have deployed this technique against domain controllers.
MITRE ATT&CK
- Technique
- T1556 Modify Authentication Process
- Sub-technique
- T1556.002 Password Filter DLL
- Canonical reference
- https://attack.mitre.org/techniques/T1556/002/
LogScale Detection Query
union(
{
#event_simpleName = "RegSetValue"
| RegObjectName = /(?i).*\\Control\\Lsa$/
| RegValueName = "Notification Packages"
| DetectionType := "LSA Notification Packages Modified"
},
{
#event_simpleName = "PeFileWritten"
| TargetFileName = /(?i).*\\Windows\\System32\\.*\.dll$/
| ImageFileName != /(?i).*(msiexec|wusa|TrustedInstaller|svchost|poqexec)\.exe$/
| DetectionType := "Suspicious DLL Written to System32"
}
)
| table(
[_time, ComputerName, UserName, #event_simpleName, DetectionType,
RegObjectName, RegValueName, RegStringValue, TargetFileName,
ImageFileName, CommandLine]
)
| sort(field=_time, order=desc)Detects T1556.002 Password Filter DLL using CrowdStrike Falcon EDR telemetry in LogScale. Uses union to combine RegSetValue events targeting LSA Notification Packages with PeFileWritten events for DLL creation in System32 by non-whitelisted processes. Requires Falcon sensor with registry monitoring and file creation telemetry enabled.
Data Sources
Required Tables
False Positives & Tuning
- CrowdStrike Falcon sensor or other EDR products that register protective DLLs in System32 and update Notification Packages as part of LSA protection features — establish a baseline of expected DLL names and authorized process names for your environment
- Third-party password filter vendors (nFront Security, Enzoic, Specops Software) performing initial installation or product updates on domain controllers — correlate with change management records to distinguish authorized from unauthorized changes
- Windows Credential Guard enablement or LSA hardening scripts that modify Notification Packages to enforce a known-good baseline — these generate a RegSetValue event matching this detection even when removing rather than adding entries
Other platforms for T1556.002
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Register a Benign Password Filter DLL
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject=HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages, Details containing 'TestPasswordFilter'. Security Event ID 4657 (registry value modified) if object access auditing is enabled.
- Test 2Drop a DLL File in System32 from Non-System Process
Expected signal: Sysmon Event ID 11 (File Create): TargetFilename=C:\Windows\System32\testpwdfilter.dll, Image=cmd.exe or powershell.exe. Security Event ID 4663 if file system auditing is enabled.
- Test 3Query Current LSA Notification Packages (Reconnaissance)
Expected signal: Security Event ID 4656/4663 (registry key access) if object access auditing is enabled. Sysmon Event ID 12 (Registry Key Opened) for HKLM\SYSTEM\CurrentControlSet\Control\Lsa.
References (6)
- https://attack.mitre.org/techniques/T1556/002/
- http://carnal0wnage.attackresearch.com/2013/09/stealing-passwords-every-time-they.html
- https://clymb3r.wordpress.com/2013/09/15/intercepting-password-changes-with-function-hooking/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1556.002/T1556.002.md
- https://docs.microsoft.com/en-us/windows/win32/secauthn/password-filter-programming-considerations
- https://www.secureworks.com/research/skeleton-key-malware-analysis
Unlock Pro Content
Get the full detection package for T1556.002 including response playbook, investigation guide, and atomic red team tests.