Suspicious security package DLL loaded

Attackers can abuse Windows Security Support Provider and Authentication Packages to dynamically inject a Security Package into the Local Security Authority Subsystem Service process to intercept all logon passwords.

• Platform: Windows
• Severity: High
• MITRE Tactic: Credential Access
• MITRE Techniques: T1003, T1003.001

Back to all rules