Techniques › T1556 › T1556.002
T1556.002 Password Filter DLL
defense impairment · persistence · credential access — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
3
Sigma rules tagged attack.t1556.002
0
KEV CVEs mapped here
<p>Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated.</p><p>Windows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as DLLs containing a method to validate potential passwords against password policies. Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts. Before registering new passwords in the Security Accounts Manager (SAM), the Local Security Authority (LSA) requests validation from each registered filter. Any potential changes cannot take effect until every registered filter acknowledges validation.</p><p>Adversaries can register malicious password filters to harvest credentials from local computers and/or entire domains. To perform proper validation, filters must receive plain-text credentials from the LSA. A malicious password filter would receive these plain-text credentials every time a password request is made.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0472 Detect Malicious Password Filter DLL Registration v1.0
AN1303 WindowsDetects suspicious registration of new password filter DLLs into the authentication process. Correlates registry modifications to LSASS Notification Packages with subsequent DLL creation and loading events. Observes anomalous file placement of DLLs in system directories followed by LSASS loading the new filter during logon/password change activity.Tunable:
RegistryPathAllowedDLLsTimeWindowFilePathPatterns
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1556.002
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2021-12-27 (modified 2024-01-22) · logsource: product=windows category=ps_script · 63bf8794-9917-45bc-88dd-e1b5abc0ecfd
Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64"
Author: Sreeman
· 2020-10-29 (modified 2022-10-09) · logsource: product=windows category=process_creation · b7966f4a-b333-455b-8370-8ca53c229762
Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS
Author: Janantha Marasinghe
· 2022-11-18 (modified 2022-12-30) · logsource: product=windows category=process_creation · c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Rules tagged at the parent level (attack.t1556) 12
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Corissa Koopmans, '@corissalea'
· 2022-07-19 · logsource: product=azure service=auditlogs · 26e7c5e2-6545-481e-b7e6-050143459635
Monitor and alert on conditional access changes where non approved actor removed CA Policy.
Author: Harjot Shah Singh, '@cyb3rjy0t'
· 2024-03-26 · logsource: product=azure service=auditlogs · 4bb80281-3756-4ec8-a88e-523c5a6fda9e
Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.
Author: AlertIQ
· 2021-10-10 (modified 2022-12-25) · logsource: product=azure service=auditlogs · 4d78a000-ab52-4564-88a5-7ab5242b20c7
Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.
Author: Corissa Koopmans, '@corissalea'
· 2022-07-19 (modified 2024-05-28) · logsource: product=azure service=auditlogs · 50a3c7aa-ec29-44a4-92c1-fce229eef6fc
Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.
Author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'
· 2022-08-04 · logsource: product=azure service=auditlogs · 665e2d43-70dc-4ccc-9d27-026c9dd7ed9c
Monitor and alert on group membership removal of groups that have CA policy modification access
Author: @ionsor
· 2022-02-08 (modified 2026-04-30) · logsource: product=azure service=auditlogs · 7ea78478-a4f9-42a6-9dcd-f861816122bf
Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.
Author: Muhammad Faisal (@faisalusuf)
· 2023-01-29 (modified 2024-07-22) · logsource: product=github service=audit · 8622c92d-c00e-463c-b09d-fd06166f6794
Detects when a user disables a critical security feature for an organization.
Author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'
· 2022-08-04 · logsource: product=azure service=auditlogs · 91c95675-1f27-46d0-bead-d1ae96b97cd3
Monitor and alert on group membership additions of groups that have CA policy modification access
Author: Nischal Khadgi
· 2024-07-11 · logsource: product=windows category=registry_set · b61e87c0-50db-4b2e-8986-6a2be94b33b0
Detects changes to "DsrmAdminLogonBehavior" registry value.
During a Domain Controller (DC) promotion, administrators create a Directory Services Restore Mode (DSRM) local administrator account with a password that rarely changes. The DSRM account is an “Administrator” account that logs in with the DSRM mode when the server is booting up to restore AD backups or recover the server from a failure.
Attackers could abuse DSRM account to maintain their persistence and access to the organization's Active Directory.
If the "DsrmAdminLogonBehavior" value is set to "0", the administrator account can only be used if the DC starts in DSRM.
If the "DsrmAdminLogonBehavior" value is set to "1", the administrator account can only be used if the local AD DS service is stopped.
If the "DsrmAdminLogonBehavior" value is set to "2", the administrator account can always be used.
Author: Harjot Shah Singh, '@cyb3rjy0t'
· 2024-03-26 · logsource: product=azure service=auditlogs · c2496b41-16a9-4016-a776-b23f8910dc58
Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.
Author: Michael McIntyre @wtfender
· 2023-09-27 · logsource: product=aws service=cloudtrail · d3adb3ef-b7e7-4003-9092-1924c797db35
Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider.
A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.
Author: Nasreddine Bencherchali (Nextron Systems), Elastic (idea)
· 2022-10-17 · logsource: product=windows service=security · f598ea0c-c25a-4f72-a219-50c44411c791
Detects possible addition of shadow credentials to an active directory object.