LSA Password Filter DLL Registration via Registry Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•14

Detects the modification of the Local Security Authority (LSA) configuration to register a malicious password filter DLL. This is achieved by looking for command-line arguments that attempt to add or modify registry keys under 'HKLM\SYSTEM\CurrentControlSet\Control\Lsa' related to password filters, specifically involving 'scecli' and 'reg add'. This technique is often used by adversaries to harvest credentials.