
title: Dropping Of Password Filter DLL
author: Sreeman
date: 2020/10/29
description: Detects dropping of dll files in system32 that may be used to retrieve
  user credentials from LSASS
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    CommandLine: '*HKLM\SYSTEM\CurrentControlSet\Control\Lsa*'
  SELECTION_3:
    CommandLine: '*scecli\0*'
  SELECTION_4:
    CommandLine: '*reg add*'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3 and SELECTION_4)
falsepositives:
- unknown
id: b7966f4a-b333-455b-8370-8ca53c229762
level: medium
logsource:
  category: process_creation
  product: windows
modified: 2021/06/11
references:
- https://pentestlab.blog/2020/02/10/credential-access-password-filter-dll/
- https://github.com/3gstudent/PasswordFilter/tree/master/PasswordFilter
status: experimental
tags:
- attack.credential_access
- attack.t1174
- attack.t1556.002
ruletype: SIGMA
