Modify Authentication Process is a Persistence technique where an adversary alters how authentication works on a system so they can continuously regain access, even after credentials change or systems reboot.

Instead of relying on stolen credentials alone, attackers embed themselves into the authentication mechanism itself, effectively becoming part of the login flow.

Why attackers love this technique

• Survives password resets
• Often invisible to MFA
• Executes before normal user sessions
• Can grant SYSTEM/root privileges

---

High-Level Goals

• Backdoor authentication
• Bypass MFA / smart cards
• Create hidden access paths
• Maintain long-term persistence

---

Sub-Techniques of Modify Authentication Process

---

1. Password Filter DLL (Windows)

What It Is

Windows allows password filter DLLs to be loaded by the Local Security Authority Subsystem Service (LSASS) to enforce password policies.

Attackers can register a malicious DLL that:

• Captures plaintext passwords
• Allows specific “magic” passwords
• Weakens or bypasses policy enforcement

Technical Details

• Registry location: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages
• DLL is loaded by lsass.exe at boot
• Runs with SYSTEM privileges
• Affects local and domain accounts

Attack Flow

1. Attacker gains admin or SYSTEM access
2. Drops malicious DLL
3. Registers DLL in LSA registry key
4. On next boot or password change, DLL executes

IOCs

• Unexpected DLLs in: C:\Windows\System32\
• Registry modification to Notification Packages
• LSASS loading unsigned DLLs
• Passwords written to disk or exfiltrated

Real-World Use

• Seen in APT-style domain persistence
• Used in stealthy AD compromises where attackers expect password resets

---

2. Authentication Package Modification (Windows)

What It Is

Windows authentication uses authentication packages (e.g., MSV1_0, Kerberos) loaded by LSASS.

Attackers register a custom authentication package that:

• Accepts attacker-controlled credentials
• Logs credentials
• Bypasses authentication logic

Technical Details

• Registry key: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages
• Loaded at system startup
• Executed inside LSASS

Attack Flow

1. Admin-level access obtained
2. Malicious auth package DLL added
3. Registry updated
4. Attacker authenticates using backdoor logic

IOCs

• New entries in Authentication Packages
• LSASS loading non-Microsoft DLLs
• Credential harvesting artifacts

Real-World Example

• Advanced attackers targeting Domain Controllers
• Often paired with Golden Ticket attacks

---

3. Pluggable Authentication Modules (PAM) – Linux / Unix

What It Is

Linux systems use PAM to define authentication behavior for:

• SSH
• sudo
• login
• su

Attackers modify PAM configs to:

• Accept hardcoded passwords
• Log credentials
• Allow access regardless of password

Technical Details

• Config files: /etc/pam.d/* /etc/pam.conf
• Modules: pam_unix.so pam_exec.so pam_permit.so
• Malicious module can run arbitrary commands

Attack Flow

1. Root access achieved
2. PAM config altered or malicious module dropped
3. Authentication hijacked silently

IOCs

• Unexpected changes in /etc/pam.d/
• New .so files in: /lib/security/
• PAM configs calling scripts or binaries

Real-World Use

• Used in cloud VM persistence
• Common in cryptomining botnets and APT intrusions

---

4. Credential Provider Modification (Windows)

What It Is

Credential Providers control how credentials are collected (login screen, RDP, UAC).

Attackers replace or add providers to:

• Capture credentials
• Add hidden login options
• Auto-authenticate attacker accounts

Technical Details

• Registry path: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers
• Implemented as COM objects (DLLs)

Attack Flow

1. Admin privileges obtained
2. Malicious Credential Provider registered
3. Executes during logon UI display

IOCs

• New GUIDs under Credential Providers
• Suspicious DLLs in: C:\Windows\System32\
• Credential harvesting artifacts

Real-World Use

• Observed in targeted espionage attacks
• Often paired with fake MFA prompts

---

5. Domain Authentication Trust Modification (Active Directory)

What It Is

Attackers modify domain trust relationships or authentication settings to:

• Accept forged tickets
• Trust attacker-controlled domains
• Maintain access across forests

Technical Details

• Kerberos trust keys (krbtgt)
• SIDHistory abuse
• Inter-domain trust manipulation

Attack Flow

1. Domain Admin access
2. Trust or Kerberos configuration altered
3. Persistent cross-domain access achieved

IOCs

• Unexpected trust relationships
• Kerberos anomalies
• SIDHistory misuse
• Event IDs: 4768, 4769, 4771

Real-World Example

• Used by APT29 in long-term AD compromises

---

Detection & Indicators of Compromise (IOCs)

Host-Based

• LSASS loading unsigned or unknown DLLs
• Registry modifications under LSA paths
• Modified PAM configuration files
• New authentication-related binaries

Network-Based

• Authentication success with invalid credentials
• Logins after password resets
• Unusual Kerberos ticket lifetimes

Log Sources

• Windows Security Event Log
• Sysmon (Event ID 7 – Image Load)
• Linux auth logs (/var/log/auth.log)
• AD event logs

---

Incident Response (IR) Guidance

Immediate Actions

1. Isolate affected systems
2. Do NOT reboot immediately (LSASS memory artifacts)
3. Dump memory for credential analysis
4. Collect authentication-related registry keys

Eradication

• Remove unauthorized authentication DLLs/modules
• Restore registry keys from known-good baselines
• Rebuild compromised domain controllers if needed
• Rotate all credentials, including service accounts

Recovery

• Reimage affected hosts
• Re-establish trust relationships
• Enable LSASS protection (RunAsPPL)
• Apply file integrity monitoring (FIM)

Lessons Learned

• Monitor authentication components, not just logins
• Harden LSASS and PAM
• Limit Domain Admin exposure

---

Consolidated Table (As Requested)

Sub-Technique	Platform	Persistence Method	Privilege Level	Key IOCs	Real-World Usage
Password Filter DLL	Windows	LSASS DLL injection	SYSTEM	Registry LSA changes, unknown DLLs	AD persistence
Authentication Package	Windows	Custom auth DLL	SYSTEM	Modified Authentication Packages	Domain takeover
PAM Modification	Linux	Auth module hijack	root	PAM config changes	Cloud persistence
Credential Provider	Windows	Logon UI backdoor	SYSTEM	New GUIDs, DLLs	Credential theft
Domain Trust Modification	AD	Kerberos / trust abuse	Domain Admin	Kerberos anomalies	Nation-state APTs