Authentication DLL Replaced on Remote Host

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects network traffic on TCP port 445 (SMB) containing the strings "system32" and "msv1_0.dll" in a case-insensitive manner. This pattern is indicative of an attempt to replace the authentication DLL (msv1_0.dll) on a remote Windows host, which is a known technique for persistence and credential manipulation.