Domain Controller Authentication Package Modified

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects network traffic on TCP port 445 (SMB) containing the string 'lsasrv.dll' in a case-insensitive manner, indicating a potential attempt to modify the Domain Controller's authentication package. This activity is often associated with persistence techniques where an attacker modifies or replaces legitimate authentication packages to maintain access or elevate privileges.