Potential LSA password filter (PowerShell)

id: '8154.34953'
title: Potential LSA password filter
description: 'Adversaries may register malicious password filter dynamic link libraries
  (DLLs) into the authentication process to acquire user credentials as they are validated.
  Windows password filters are password policy enforcement mechanisms for both domain
  and local accounts. This use case looks for values added to LSA registry with reg.exe
  - Software Association: Cactus, Vice Society - Atomics T1556.002 Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") ((TERM(Set-ItemProperty)
  OR TERM(sp) OR (TERM(reg) TERM(add)))) ("HKLM" OR "HKEY_LOCAL_MACHINE") ("lsa" "control")
  | table _time, host, user process, process_*, signature_id, parent_* | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:modify authentication process:password filter dll
- privilege-escalation:boot or logon autostart execution:authentication package
- persistence:boot or logon autostart execution:authentication package
- persistence:modify authentication process:password filter dll
- credential-access:modify authentication process:password filter dll
technique_id:
- T1556.002
- T1547.002
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07190154/The-ProjectSauron-APT_research_KL.pdf