Suspicious Process Loading Windows Hello Authentication Components
This rule detects potentially unauthorized processes loading sensitive Windows authentication-related DLLs, specifically those associated with Microsoft Entra ID (formerly Azure AD) and Windows Hello functionality. By filtering against a list of known, legitimate processes, the rule identifies non-Microsoft signed processes that may be attempting to interact with authentication modules, which is a common pattern in credential theft or token manipulation attacks.
Microsoft Sentinel (KQL)
