Or hunt for all reg add commands involving 'Security Packages' (again, check for details).

I checked our case database and found the screenshots from 2 years ago, where the attackers used the same technique to capture cleartext passwords.įrom a hunting perspective, reading out the relevant registry key (see for the exact reg query command) on all endpoints should be easy enough with an EDR or Velociraptor, for example.

Once the Security Package is registered and the system is rebooted, the mimilib.dll will be loaded into lsass.exe process memory and intercept all logon passwords next time someone logs onto the system or otherwise authenticates, say, via runas.exe.' Ī Threat Actor used exactly this technique outlined above in one of our latest Incident Response cases, to register a malicious DLL as a Security Package (see the screenshot below). 'Mimikatz Security Support Provider mimilib.dll will be registered as a Windows Security Package.