Authentication Package DLL Persistence
Detects modifications to the 'Authentication Packages' registry key that include a DLL, which can be used for persistence by adversaries. The Local Security Authority (LSA) process loads these DLLs at system startup.
Microsoft Sentinel (KQL)
