T1556.002 — Password Filter DLL

Tactics: Defense Impairment, Persistence, Credential Access · Platforms: Windows

Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated. Windows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as…

Sub-technique of Modify Authentication Process (T1556).

Sigma detection rules (1)

T1556.002 Modify Authentication Process: Password Filter DLL

title: "T1556.002 Modify Authentication Process: Password Filter DLL"
id: d30b8561-8936-461a-8978-b569075d434f
description: 'Detects registration of a new DLL under LSA Notification Packages registry key, abused by malicious password filter DLLs. (Data Component: Registry Modification; baseline tier: windows-eventid.) Tune using: RegistryPath, AllowedDLLs, TimeWindow, FilePathPatterns.'
references:
  - https://attack.mitre.org/techniques/T1556/002
author: Shahrukh Khan
date: 2026-04-28
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.002

logsource:
  category: registry_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '13'
    TargetObject|endswith: '\Control\Lsa\Notification Packages'
  condition: selection

falsepositives:
  - Legitimate password filter/policy-enforcement software registering under Notification Packages.

level: medium

Related sub-techniques

Explore