What exploitation technique is demonstrated for hiding a Password Filter DLL, and does it evade Additional LSA Protection?
The technique involves using a Long UNC filename to disguise a malicious DLL as `scecli.dll` with a trailing space, causing it to be loaded alongside the legitimate `scecli.dll` by `lsass.exe`. The DLL is saved as `\?\C:\windows\system32\scecli.dll ` and its short name (SCECLI~1.DLL) is added to the `Notification Packages` registry value. While this achieves a form of DLL "hiding" in Process Explorer, Additional LSA Protection successfully detects the non-compliant DLL and logs Event 3066, as shown in the Application of Password Filter DLL in Penetration Testing article.
Long UNC filenameDLL spoofingscecli.dllPassword Filter DLLprocess injection