Detect Password Filter DLL in Microsoft Sentinel
Adversaries may register malicious password filter DLLs to harvest credentials as they are validated. Windows password filters are DLLs that implement password policy enforcement — the LSA calls each registered filter with plaintext credentials before accepting a password change. A malicious filter receives plaintext passwords every time any user changes their password. Threat groups Strider (ProjectSauron/Remsec) and OilRig have deployed this technique against domain controllers.
MITRE ATT&CK
- Technique
- T1556 Modify Authentication Process
- Sub-technique
- T1556.002 Password Filter DLL
- Canonical reference
- https://attack.mitre.org/techniques/T1556/002/
KQL Detection Query
let PasswordFilterRegistryKeys = dynamic([
@"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages",
@"HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages"
]);
let RegistryChanges = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has "Control\\Lsa" and RegistryValueName =~ "Notification Packages"
| project Timestamp, DeviceName, AccountName, ActionType, RegistryKey,
RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine;
let DLLsInSystem32 = DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath =~ @"C:\Windows\System32"
| where FileName endswith ".dll"
| where InitiatingProcessFileName !in~ ("msiexec.exe", "wusa.exe", "TrustedInstaller.exe", "svchost.exe")
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName,
InitiatingProcessCommandLine, SHA256;
union RegistryChanges, DLLsInSystem32
| sort by Timestamp descDetects malicious password filter DLL registration by monitoring changes to the LSA Notification Packages registry key (where password filter DLLs are registered) and unexpected DLL drops into System32. Password filter DLLs must reside in System32 and be listed in this registry value to receive plaintext credentials during password changes.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate enterprise password policy enforcement tools (e.g., Enzoic, nFront Security Password Filter) that register valid password filter DLLs
- Microsoft's own passfilt.dll which is installed by default and listed in Notification Packages
- Domain controller software updates or Group Policy enforcement tools that modify LSA security packages
- Third-party identity management solutions (e.g., CyberArk, BeyondTrust) that install password interception components
Other platforms for T1556.002
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Register a Benign Password Filter DLL
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject=HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages, Details containing 'TestPasswordFilter'. Security Event ID 4657 (registry value modified) if object access auditing is enabled.
- Test 2Drop a DLL File in System32 from Non-System Process
Expected signal: Sysmon Event ID 11 (File Create): TargetFilename=C:\Windows\System32\testpwdfilter.dll, Image=cmd.exe or powershell.exe. Security Event ID 4663 if file system auditing is enabled.
- Test 3Query Current LSA Notification Packages (Reconnaissance)
Expected signal: Security Event ID 4656/4663 (registry key access) if object access auditing is enabled. Sysmon Event ID 12 (Registry Key Opened) for HKLM\SYSTEM\CurrentControlSet\Control\Lsa.
References (6)
- https://attack.mitre.org/techniques/T1556/002/
- http://carnal0wnage.attackresearch.com/2013/09/stealing-passwords-every-time-they.html
- https://clymb3r.wordpress.com/2013/09/15/intercepting-password-changes-with-function-hooking/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1556.002/T1556.002.md
- https://docs.microsoft.com/en-us/windows/win32/secauthn/password-filter-programming-considerations
- https://www.secureworks.com/research/skeleton-key-malware-analysis
Unlock Pro Content
Get the full detection package for T1556.002 including response playbook, investigation guide, and atomic red team tests.