T1556.002 Password Filter DLL — Attack Simulation

Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated. Windows password filters are password policy enforcement mechanisms for both domain and local accounts. Filters are implemented as DLLs containing a method to validate potential passwords against password policies. Filter DLLs can be positioned on local computers for local accounts…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

Install Additional Authentication Packages
windows automated powershell
Procedure 91580da6-bc6e-431b-8b88-ac77180005f2; elevation required; cleanup present, not reviewed. Not executed or individually validated.
Install and Register Password Filter DLL
windows automated powershell
Procedure a7961770-beb5-4134-9674-83d7e1fa865c; elevation required; cleanup present, not reviewed. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint onprem Windows credential-access defense-impairment persistence isolated_authorized_lab procedure_review_required telemetry_configuration_required some_candidates_require_elevation potential_disruption_requires_individual_review

can_simulate subtechnique source_mapped

Detection and collection

T1556.002 detection workspace

Attack tools

No reviewed association in this snapshot.

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.