Authentication Package DLL Registered via Registry

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects network traffic to port 445 (SMB) containing the case-insensitive string "Authentication Packages". This string is often associated with the registration of malicious authentication package DLLs via the Windows Registry, a technique used for persistence and credential access. The rule specifically looks for this content in established TCP connections flowing to the home network.