Suspicious DLL in Authentication Packages Registry Key
Detects modifications to the 'Authentication Packages' registry key that include a '.dll' file. Adversaries may abuse authentication packages to execute DLLs when the system boots, establishing persistence and potentially escalating privileges.
Microsoft Sentinel (KQL)
