Detect Password Filter DLL in IBM QRadar
Adversaries may register malicious password filter DLLs to harvest credentials as they are validated. Windows password filters are DLLs that implement password policy enforcement — the LSA calls each registered filter with plaintext credentials before accepting a password change. A malicious filter receives plaintext passwords every time any user changes their password. Threat groups Strider (ProjectSauron/Remsec) and OilRig have deployed this technique against domain controllers.
MITRE ATT&CK
- Technique
- T1556 Modify Authentication Process
- Sub-technique
- T1556.002 Password Filter DLL
- Canonical reference
- https://attack.mitre.org/techniques/T1556/002/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
LOGSOURCENAME(logsourceid) AS LogSource,
LOGSOURCETYPENAME(devicetype) AS LogSourceType,
hostname,
username,
"EventID",
"TargetObject",
"Details",
"TargetFilename",
"Image",
"CommandLine"
FROM events
WHERE
LOGSOURCETYPEID(logsourceid) = 12
AND (
(
"EventID" = '13'
AND "TargetObject" ILIKE '%\\Control\\Lsa\\Notification Packages%'
)
OR
(
"EventID" = '11'
AND "TargetFilename" ILIKE '%\\Windows\\System32\\%.dll'
AND "Image" NOT ILIKE '%\\msiexec.exe'
AND "Image" NOT ILIKE '%\\wusa.exe'
AND "Image" NOT ILIKE '%\\TrustedInstaller.exe'
AND "Image" NOT ILIKE '%\\svchost.exe'
AND "Image" NOT ILIKE '%\\poqexec.exe'
)
)
ORDER BY starttime DESC
LAST 24 HOURSDetects T1556.002 Password Filter DLL by monitoring Sysmon EventID 13 (Registry Value Set) for modifications to the LSA Notification Packages registry key, and Sysmon EventID 11 (File Create) for suspicious DLL creation in System32 by non-whitelisted processes. LOGSOURCETYPEID 12 corresponds to Microsoft Windows Security Event Log — adjust to match your Sysmon DSM configuration.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate password filter products (nFront, Enzoic, SpecOps) registering their DLLs in Notification Packages during installation or version upgrades on Windows domain controllers
- Security agent installations from endpoint protection vendors that write DLLs to System32 as part of LSA protection or credential guard features during initial deployment
- Domain controller patching via WSUS or SCCM where Windows Update delivers DLL updates through processes not present in the exclusion list during staged or out-of-band patching cycles
Other platforms for T1556.002
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Register a Benign Password Filter DLL
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject=HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages, Details containing 'TestPasswordFilter'. Security Event ID 4657 (registry value modified) if object access auditing is enabled.
- Test 2Drop a DLL File in System32 from Non-System Process
Expected signal: Sysmon Event ID 11 (File Create): TargetFilename=C:\Windows\System32\testpwdfilter.dll, Image=cmd.exe or powershell.exe. Security Event ID 4663 if file system auditing is enabled.
- Test 3Query Current LSA Notification Packages (Reconnaissance)
Expected signal: Security Event ID 4656/4663 (registry key access) if object access auditing is enabled. Sysmon Event ID 12 (Registry Key Opened) for HKLM\SYSTEM\CurrentControlSet\Control\Lsa.
References (6)
- https://attack.mitre.org/techniques/T1556/002/
- http://carnal0wnage.attackresearch.com/2013/09/stealing-passwords-every-time-they.html
- https://clymb3r.wordpress.com/2013/09/15/intercepting-password-changes-with-function-hooking/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1556.002/T1556.002.md
- https://docs.microsoft.com/en-us/windows/win32/secauthn/password-filter-programming-considerations
- https://www.secureworks.com/research/skeleton-key-malware-analysis
Unlock Pro Content
Get the full detection package for T1556.002 including response playbook, investigation guide, and atomic red team tests.