Elastic Security Detection Rules

Untrusted DLL Loaded by Azure AD Connect Authentication Agent

Last updated 2 months ago on 2026-04-24
Created 2 years ago on 2024-10-14

About

Identifies the load of an untrusted DLL by the Azure AD Connect Authentication Agent, which may indicate an attempt to persist or intercept credentials passing through the Pass-through Authentication service.
Tags
Domain: EndpointOS: WindowsUse Case: Threat DetectionTactic: Credential AccessData Source: Elastic DefendData Source: SysmonLanguage: eql
Severity
high
Risk Score
73
MITRE ATT&CK™

Credential Access (TA0006)(external, opens in a new tab or window)

↳ OS Credential Dumping (T1003)(external, opens in a new tab or window)

↳ Modify Authentication Process (T1556)(external, opens in a new tab or window)

Defense Evasion (TA0005)(external, opens in a new tab or window)

↳ Hijack Execution Flow (T1574)(external, opens in a new tab or window)

License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
Event Correlation Rule
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
winlogbeat-*logs-endpoint.events.library-*logs-windows.sysmon_operational-*
Related Integrations

endpoint(external, opens in a new tab or window)

windows(external, opens in a new tab or window)

Query
text code block:
library where host.os.type == "windows" and process.name : "AzureADConnectAuthenticationAgentService.exe" and

not dll.code_signature.trusted == true and
not dll.path : (
    "?:\\Windows\\assembly\\NativeImages*",
    "?:\\Windows\\Microsoft.NET\\*",
    "?:\\Windows\\WinSxS\\*",
    "?:\\Windows\\System32\\DriverStore\\FileRepository\\*"
)

Install detection rules in Elastic Security

Detect Untrusted DLL Loaded by Azure AD Connect Authentication Agent in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).