Detect Modify Authentication Process in Splunk

index=wineventlog (
    (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=13 OR EventCode=7))
    OR (sourcetype="WinEventLog:Security" (EventCode=4657 OR EventCode=4614 OR EventCode=4610))
)
| eval TargetPath=coalesce(TargetObject, ObjectName)
| eval InitProcess=coalesce(Image, ProcessName)
| eval LoadedImage=coalesce(ImageLoaded, "")
| eval User=coalesce(User, SubjectUserName)
```
-- Branch 1: Sysmon Registry Value Set (EventCode=13) on LSA keys
```
| eval IsAuthRegistryMod=if(
    EventCode=13 AND (
        like(TargetPath, "%\\Control\\Lsa\\Notification Packages%") OR
        like(TargetPath, "%\\Control\\Lsa\\Security Packages%") OR
        like(TargetPath, "%\\Control\\Lsa\\Authentication Packages%") OR
        like(TargetPath, "%\\Control\\NetworkProvider\\Order%") OR
        like(TargetPath, "%\\Winlogon\\GinaDLL%") OR
        like(TargetPath, "%\\Authentication\\Credential Providers%")
    ), 1, 0)
```
-- Branch 2: Windows Security audit of notification/auth package loading
```
| eval IsAuthPackageLoad=if(
    (EventCode=4614 OR EventCode=4610),
    1, 0)
```
-- Branch 3: Sysmon Image Load (EventCode=7) by lsass for unexpected DLLs
```
| eval IsLsassLoad=if(
    EventCode=7 AND like(InitProcess, "%lsass.exe") AND NOT (
        like(LoadedImage, "%\\ntdll.dll") OR like(LoadedImage, "%\\kernel32.dll") OR
        like(LoadedImage, "%\\kerberos.dll") OR like(LoadedImage, "%\\msv1_0.dll") OR
        like(LoadedImage, "%\\wdigest.dll") OR like(LoadedImage, "%\\tspkg.dll") OR
        like(LoadedImage, "%\\pku2u.dll") OR like(LoadedImage, "%\\lsasrv.dll") OR
        like(LoadedImage, "%\\samsrv.dll") OR like(LoadedImage, "%\\netlogon.dll") OR
        like(LoadedImage, "%\\schannel.dll") OR like(LoadedImage, "%\\cloudap.dll")
    ), 1, 0)
| where IsAuthRegistryMod=1 OR IsAuthPackageLoad=1 OR IsLsassLoad=1
| where NOT (like(InitProcess, "%TrustedInstaller.exe") OR like(InitProcess, "%MsMpEng.exe") OR like(InitProcess, "%msiexec.exe") OR like(InitProcess, "%wuauclt.exe"))
| eval DetectionType=case(
    IsLsassLoad=1, "Unexpected DLL Load by LSASS",
    IsAuthPackageLoad=1, "Authentication Package Loaded by SAM/LSA",
    like(TargetPath, "%Notification Packages%"), "Password Filter DLL Registration",
    like(TargetPath, "%Security Packages%"), "SSP Registration",
    like(TargetPath, "%Authentication Packages%"), "Authentication Package Registration",
    like(TargetPath, "%NetworkProvider%"), "Network Provider DLL Registration",
    like(TargetPath, "%GinaDLL%"), "GINA DLL Modification",
    true(), "LSA Authentication Modification"
)
| eval Severity=case(
    DetectionType="Password Filter DLL Registration", "Critical",
    DetectionType="SSP Registration", "Critical",
    DetectionType="GINA DLL Modification", "Critical",
    DetectionType="Unexpected DLL Load by LSASS", "High",
    true(), "High"
)
| table _time, host, User, DetectionType, Severity, TargetPath, Details, LoadedImage, InitProcess, CommandLine
| sort - _time