Esc
Password Filter DLL - T1556.002

(ATT&CK® Technique)
Definition

Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated.
D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.
        graph LR;

     T1556002["Password Filter DLL"] --> |modifies| SystemConfigurationDatabaseRecord["System Configuration Database Record"]; class T1556002 OffensiveTechniqueNode;
        class SystemConfigurationDatabaseRecord ArtifactNode; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord";
        click T1556002 href "/offensive-technique/attack/T1556.002/"; click SystemConfigurationDatabaseRecord href "/dao/artifact/d3f:SystemConfigurationDatabaseRecord"; T1556002["Password Filter DLL"] --> |creates| SharedLibraryFile["Shared Library File"]; class T1556002 OffensiveTechniqueNode;
        class SharedLibraryFile ArtifactNode; click SharedLibraryFile href "/dao/artifact/d3f:SharedLibraryFile";
        click T1556002 href "/offensive-technique/attack/T1556.002/"; click SharedLibraryFile href "/dao/artifact/d3f:SharedLibraryFile";   T1556002["Password Filter DLL"] --> |modifies| AuthenticationService["Authentication Service"]; class T1556002 OffensiveTechniqueNode;
        class AuthenticationService ArtifactNode; click AuthenticationService href "/dao/artifact/d3f:AuthenticationService";
        click T1556002 href "/offensive-technique/attack/T1556.002/"; click AuthenticationService href "/dao/artifact/d3f:AuthenticationService";                         DecoyFile["Decoy File"] -->
          | spoofs | SharedLibraryFile["Shared Library File"];

          DecoyFile["Decoy File"] -.->
            | may-deceive | T1556002["Password Filter DLL"] ;
          class DecoyFile DefensiveTechniqueNode;
          class SharedLibraryFile ArtifactNode;
          click DecoyFile href "/technique/d3f:DecoyFile"; FileEviction["File Eviction"] -->
          | deletes | SharedLibraryFile["Shared Library File"];

          FileEviction["File Eviction"] -.->
            | may-evict | T1556002["Password Filter DLL"] ;
          class FileEviction DefensiveTechniqueNode;
          class SharedLibraryFile ArtifactNode;
          click FileEviction href "/technique/d3f:FileEviction";                           FileEncryption["File Encryption"] -->
          | encrypts | SharedLibraryFile["Shared Library File"];

          FileEncryption["File Encryption"] -.->
            | may-harden | T1556002["Password Filter DLL"] ;
          class FileEncryption DefensiveTechniqueNode;
          class SharedLibraryFile ArtifactNode;
          click FileEncryption href "/technique/d3f:FileEncryption"; ProcessTermination["Process Termination"] -->
          | terminates | AuthenticationService["Authentication Service"];

          ProcessTermination["Process Termination"] -.->
            | may-evict | T1556002["Password Filter DLL"] ;
          class ProcessTermination DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click ProcessTermination href "/technique/d3f:ProcessTermination"; ProcessSuspension["Process Suspension"] -->
          | suspends | AuthenticationService["Authentication Service"];

          ProcessSuspension["Process Suspension"] -.->
            | may-evict | T1556002["Password Filter DLL"] ;
          class ProcessSuspension DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click ProcessSuspension href "/technique/d3f:ProcessSuspension"; HostShutdown["Host Shutdown"] -->
          | terminates | AuthenticationService["Authentication Service"];

          HostShutdown["Host Shutdown"] -.->
            | may-evict | T1556002["Password Filter DLL"] ;
          class HostShutdown DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click HostShutdown href "/technique/d3f:HostShutdown";                 LocalFilePermissions["Local File Permissions"] -->
          | restricts | SharedLibraryFile["Shared Library File"];

          LocalFilePermissions["Local File Permissions"] -.->
            | may-isolate | T1556002["Password Filter DLL"] ;
          class LocalFilePermissions DefensiveTechniqueNode;
          class SharedLibraryFile ArtifactNode;
          click LocalFilePermissions href "/technique/d3f:LocalFilePermissions"; Kernel-basedProcessIsolation["Kernel-based Process Isolation"] -->
          | isolates | AuthenticationService["Authentication Service"];

          Kernel-basedProcessIsolation["Kernel-based Process Isolation"] -.->
            | may-isolate | T1556002["Password Filter DLL"] ;
          class Kernel-basedProcessIsolation DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click Kernel-basedProcessIsolation href "/technique/d3f:Kernel-basedProcessIsolation"; Application-basedProcessIsolation["Application-based Process Isolation"] -->
          | isolates | AuthenticationService["Authentication Service"];

          Application-basedProcessIsolation["Application-based Process Isolation"] -.->
            | may-isolate | T1556002["Password Filter DLL"] ;
          class Application-basedProcessIsolation DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click Application-basedProcessIsolation href "/technique/d3f:Application-basedProcessIsolation"; Hardware-basedProcessIsolation["Hardware-based Process Isolation"] -->
          | isolates | AuthenticationService["Authentication Service"];

          Hardware-basedProcessIsolation["Hardware-based Process Isolation"] -.->
            | may-isolate | T1556002["Password Filter DLL"] ;
          class Hardware-basedProcessIsolation DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click Hardware-basedProcessIsolation href "/technique/d3f:Hardware-basedProcessIsolation";                 RestoreFile["Restore File"] -->
          | restores | SharedLibraryFile["Shared Library File"];

          RestoreFile["Restore File"] -.->
            | may-restore | T1556002["Password Filter DLL"] ;
          class RestoreFile DefensiveTechniqueNode;
          class SharedLibraryFile ArtifactNode;
          click RestoreFile href "/technique/d3f:RestoreFile"; ProcessSelf-ModificationDetection["Process Self-Modification Detection"] -->
          | analyzes | AuthenticationService["Authentication Service"];

          ProcessSelf-ModificationDetection["Process Self-Modification Detection"] -.->
            | may-detect | T1556002["Password Filter DLL"] ;
          class ProcessSelf-ModificationDetection DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click ProcessSelf-ModificationDetection href "/technique/d3f:ProcessSelf-ModificationDetection"; ProcessSpawnAnalysis["Process Spawn Analysis"] -->
          | analyzes | AuthenticationService["Authentication Service"];

          ProcessSpawnAnalysis["Process Spawn Analysis"] -.->
            | may-detect | T1556002["Password Filter DLL"] ;
          class ProcessSpawnAnalysis DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click ProcessSpawnAnalysis href "/technique/d3f:ProcessSpawnAnalysis";  FileIntegrityMonitoring["File Integrity Monitoring"] -->
          | analyzes | SharedLibraryFile["Shared Library File"];

          FileIntegrityMonitoring["File Integrity Monitoring"] -.->
            | may-detect | T1556002["Password Filter DLL"] ;
          class FileIntegrityMonitoring DefensiveTechniqueNode;
          class SharedLibraryFile ArtifactNode;
          click FileIntegrityMonitoring href "/technique/d3f:FileIntegrityMonitoring";                          RestoreConfiguration["Restore Configuration"] -->
          | restores | SystemConfigurationDatabaseRecord["System Configuration Database Record"];

          RestoreConfiguration["Restore Configuration"] -.->
            | may-restore | T1556002["Password Filter DLL"] ;
          class RestoreConfiguration DefensiveTechniqueNode;
          class SystemConfigurationDatabaseRecord ArtifactNode;
          click RestoreConfiguration href "/technique/d3f:RestoreConfiguration";                 SystemCallFiltering["System Call Filtering"] -->
          | isolates | AuthenticationService["Authentication Service"];

          SystemCallFiltering["System Call Filtering"] -.->
            | may-isolate | T1556002["Password Filter DLL"] ;
          class SystemCallFiltering DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click SystemCallFiltering href "/technique/d3f:SystemCallFiltering";               RemoteFileAccessMediation["Remote File Access Mediation"] -->
          | isolates | SharedLibraryFile["Shared Library File"];

          RemoteFileAccessMediation["Remote File Access Mediation"] -.->
            | may-isolate | T1556002["Password Filter DLL"] ;
          class RemoteFileAccessMediation DefensiveTechniqueNode;
          class SharedLibraryFile ArtifactNode;
          click RemoteFileAccessMediation href "/technique/d3f:RemoteFileAccessMediation";  WebSessionAccessMediation["Web Session Access Mediation"] -->
          | isolates | AuthenticationService["Authentication Service"];

          WebSessionAccessMediation["Web Session Access Mediation"] -.->
            | may-isolate | T1556002["Password Filter DLL"] ;
          class WebSessionAccessMediation DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click WebSessionAccessMediation href "/technique/d3f:WebSessionAccessMediation";              FileAnalysis["File Analysis"] -->
          | analyzes | SharedLibraryFile["Shared Library File"];

          FileAnalysis["File Analysis"] -.->
            | may-detect | T1556002["Password Filter DLL"] ;
          class FileAnalysis DefensiveTechniqueNode;
          class SharedLibraryFile ArtifactNode;
          click FileAnalysis href "/technique/d3f:FileAnalysis";              HostReboot["Host Reboot"] -->
          | terminates | AuthenticationService["Authentication Service"];

          HostReboot["Host Reboot"] -.->
            | may-evict | T1556002["Password Filter DLL"] ;
          class HostReboot DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click HostReboot href "/technique/d3f:HostReboot"; ProcessLineageAnalysis["Process Lineage Analysis"] -->
          | analyzes | AuthenticationService["Authentication Service"];

          ProcessLineageAnalysis["Process Lineage Analysis"] -.->
            | may-detect | T1556002["Password Filter DLL"] ;
          class ProcessLineageAnalysis DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click ProcessLineageAnalysis href "/technique/d3f:ProcessLineageAnalysis";
json