Windows lets administrators enforce password rules through filter DLLs. That is useful, and it also means a filter receives passwords in plaintext. MITRE ATT&CK technique T1556.002, Password Filter DLL, covers registering a malicious filter to harvest credentials. The tactics are defense impairment, persistence and credential access, and the platform is Windows.
How attackers use it
Password filters are policy enforcement mechanisms for domain and local accounts. A filter DLL contains a method that validates a candidate password against policy. Filters can be placed on local computers for local accounts and on domain controllers for domain accounts. Before registering a new password in the Security Accounts Manager, the Local Security Authority asks each registered filter to validate it, and the change cannot take effect until every filter acknowledges.
To validate properly, filters must receive plain text credentials from the LSA. MITRE notes a malicious filter would therefore receive plaintext credentials every time a password request is made, across local computers or an entire domain.
How to detect it
MITRE lists no data sources here. The registration point gives a clear target:
- Changes to the
Notification Packagesvalue underHKLM\SYSTEM\CurrentControlSet\Control\Lsa. Sysmon registry events 12 and 13, or Windows event 4657 with auditing, capture these. - New DLLs written to
C:\Windows\System32on domain controllers. - A password filter DLL name in the registry that you cannot match to a product or to your own policy tool.
Review it after every domain controller patch cycle, because the legitimate list is short and stable.
How to reduce the risk
MITRE lists one mitigation, operating system configuration: ensure only valid password filters are registered. Filter DLLs must be present in the Windows installation directory (C:\Windows\System32\ by default) of the domain controller or local computer, with a matching entry in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages.
Check it with this read-only command on each domain controller:
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" | Select-Object -ExpandProperty "Notification Packages"
Compare the result across all domain controllers. They should match.
Quick check
Why would a filter DLL see plaintext passwords?
To validate a candidate password against policy, a filter must receive the plain text credential from the LSA, so a malicious filter receives it too.
