Skip to content

Hide Navigation Hide TOC

Dropping Of Password Filter DLL (b7966f4a-b333-455b-8370-8ca53c229762)

Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS

Cluster A Galaxy A Cluster B Galaxy B Level
Password Filter DLL - T1556.002 (3731fbcd-0e43-47ae-ae6c-d15e510f0d42) Attack Pattern Dropping Of Password Filter DLL (b7966f4a-b333-455b-8370-8ca53c229762) Sigma-Rules 1
Modify Authentication Process - T1556 (f4c1826f-a322-41cd-9557-562100848c84) Attack Pattern Password Filter DLL - T1556.002 (3731fbcd-0e43-47ae-ae6c-d15e510f0d42) Attack Pattern 2