Password Filter DLL Installed for Credential Harvest

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects network traffic on TCP port 445 (SMB) containing the string "Notification Packages" in a case-insensitive manner, flowing to the server. This pattern is indicative of an attempt to install a password filter DLL for credential harvesting, a technique used by attackers to capture user credentials.