MirrorFaceG1054 ↗
Has used a tool named MRSAStealer as a password filter to collect credentials on password changes.1
tfMITRE ATT&CK sub-technique
Password Filter DLL T1556.002
sub-technique of T1556 Modify Authentication Process
- Platform
- Windows
- Version
- 3.0
- Created
- 11 February 2020
- Last modified
- 12 May 2026
- Contributor
- Vincent Le Toux
Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
3
Threat groups64th pct
Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.3
Detection rules54th pct
Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.Password Filter DLL MITRE reference T1556.002
64th pctamong all ATT&CK techniques for number of groups
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
OilRigG0049 ↗
Has registered a password filter DLL in order to drop malware.1
StriderG0041 ↗
Has registered its persistence module on domain controllers as a Windows LSA (Local System Authority) password filter to acquire credentials any time a domain, local user, or administrator logs in or changes a password.1
All 3 groups for this technique
Offense vs defense T1556.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 0
first rule: 2020 Q4Password Filter DLL detection strategy DET0472
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Malicious Password Filter DLL Registration
1 platform
AN1303 · Windows
Detects suspicious registration of new password filter DLLs into the authentication process. Correlates registry modifications to LSASS Notification Packages with subsequent DLL creation and loading events. Observes anomalous file placement of DLLs in system directories followed by LSASS loading the new filter during logon/password change activity.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Security | EventCode=4657 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| RegistryPath | Specific registry path monitored for modification (e.g., HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages). |
| AllowedDLLs | Known and approved password filter DLLs; deviations from baseline may indicate malicious injection. |
| TimeWindow | Time window for correlating registry modification, file creation, and module load events. |
| FilePathPatterns | Expected directories for legitimate password filter DLLs; anomalous paths may signal compromise. |
Ensure only valid password filters are registered. Filter DLLs must be present in Windows installation directory (C:\Windows\System32\ by default) of a domain controller and/or local computer with a corresponding entry in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages.
Tests2ExecutorsPowerShell 2Need elevation2 of 2Have prerequisites2Have cleanup2Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition