name: Suspicious password filter DLL registered
id: 472902be-76e9-4ee7-a48a-6275fa571cf4
version: 1.0.0
description: |
  Detects attempts to register malicious password filters to harvest credentials
  from local computers and/or entire domains. To perform proper validation,
  filters must receive plain-text credentials from the LSA. A malicious password
  filter would receive these plain-text credentials every time a password request is made.
condition: >
  sequence
  maxspan 5m
    |kevt.name = 'CreateFile'
        and
     file.name imatches '?:\\Windows\\System32\\*.dll'
    | as e1
    |kevt.name = 'RegSetValue'
        and
     registry.key.name ~= 'HKEY_CURRENT_USER\\Volatile Environment\\Notification Packages'
        and
     get_reg_value(registry.key.name) iin (base($e1.file.name, false))
    |
output: >
  <code>%1.ps.exe</code> process dropped potentially malicious
  <code>%1.file.name</code> password filter and <code>%2.ps.name</code>
  registered the password filter DLL under %2.registry.key.name registry key
min-engine-version: 2.0.0
