Windows Event ID 4610 – LSA: Authentication Package Loaded

Start by examining the specific authentication package details in Event Viewer to understand what loaded.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4610 by right-clicking the Security log and selecting Filter Current Log
4. Enter 4610 in the Event IDs field and click OK
5. Double-click on a 4610 event to view details
6. Review the Authentication Package Name field to identify which package loaded
7. Check the timestamp to correlate with system startup times
8. Note any unusual or unexpected authentication package names

Use PowerShell to efficiently query and analyze authentication package loading events across multiple systems.

1. Open PowerShell as Administrator
2. Query recent 4610 events with this command:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4610} -MaxEvents 50 | Select-Object TimeCreated, Id, @{Name='AuthPackage';Expression={($_.Message -split '\n' | Where-Object {$_ -like '*Authentication Package Name:*'}) -replace '.*Authentication Package Name:\s*',''}}

3. For detailed analysis of authentication packages loaded during last boot:

$LastBoot = (Get-CimInstance -ClassName Win32_OperatingSystem).LastBootUpTime
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4610; StartTime=$LastBoot} | ForEach-Object {
    $AuthPackage = ($_.Message -split '\n' | Where-Object {$_ -like '*Authentication Package Name:*'}) -replace '.*Authentication Package Name:\s*',''
    [PSCustomObject]@{
        TimeCreated = $_.TimeCreated
        AuthenticationPackage = $AuthPackage
        ProcessId = $_.ProcessId
    }
} | Sort-Object TimeCreated

4. Export results to CSV for further analysis:

$Results | Export-Csv -Path "C:\Temp\AuthPackages_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

Examine the registry to understand which authentication packages are configured to load and identify any unauthorized additions.

1. Open Registry Editor by pressing Win + R, typing regedit, and pressing Enter
2. Navigate to the authentication packages registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

3. Examine the Authentication Packages REG_MULTI_SZ value
4. Check the Security Packages REG_MULTI_SZ value
5. Document all listed packages and research any unfamiliar entries
6. Use PowerShell to query registry values programmatically:

$LSAKey = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"
$AuthPackages = Get-ItemProperty -Path $LSAKey -Name "Authentication Packages" -ErrorAction SilentlyContinue
$SecurityPackages = Get-ItemProperty -Path $LSAKey -Name "Security Packages" -ErrorAction SilentlyContinue

Write-Host "Authentication Packages:" -ForegroundColor Green
$AuthPackages."Authentication Packages" | ForEach-Object { Write-Host "  $_" }

Write-Host "\nSecurity Packages:" -ForegroundColor Green
$SecurityPackages."Security Packages" | ForEach-Object { Write-Host "  $_" }

Set up monitoring to track when new authentication packages are installed or existing ones are modified.

1. Create a PowerShell script to baseline current authentication packages:

# Create baseline of authentication packages
$BaselinePath = "C:\Scripts\AuthPackageBaseline.xml"
$LSAKey = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"

$Baseline = @{
    Timestamp = Get-Date
    AuthenticationPackages = (Get-ItemProperty -Path $LSAKey -Name "Authentication Packages")."Authentication Packages"
    SecurityPackages = (Get-ItemProperty -Path $LSAKey -Name "Security Packages")."Security Packages"
}

$Baseline | Export-Clixml -Path $BaselinePath
Write-Host "Baseline created at $BaselinePath" -ForegroundColor Green

2. Create a monitoring script to detect changes:

# Compare current state to baseline
$BaselinePath = "C:\Scripts\AuthPackageBaseline.xml"
$Baseline = Import-Clixml -Path $BaselinePath
$LSAKey = "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa"

$Current = @{
    AuthenticationPackages = (Get-ItemProperty -Path $LSAKey -Name "Authentication Packages")."Authentication Packages"
    SecurityPackages = (Get-ItemProperty -Path $LSAKey -Name "Security Packages")."Security Packages"
}

$AuthDiff = Compare-Object $Baseline.AuthenticationPackages $Current.AuthenticationPackages
$SecDiff = Compare-Object $Baseline.SecurityPackages $Current.SecurityPackages

if ($AuthDiff -or $SecDiff) {
    Write-Host "Authentication package changes detected!" -ForegroundColor Red
    $AuthDiff | ForEach-Object { Write-Host "Auth Package: $($_.InputObject) ($($_.SideIndicator))" }
    $SecDiff | ForEach-Object { Write-Host "Security Package: $($_.InputObject) ($($_.SideIndicator))" }
} else {
    Write-Host "No changes detected" -ForegroundColor Green
}

3. Schedule the monitoring script using Task Scheduler for regular checks

Perform comprehensive analysis to identify potential security threats related to authentication package modifications.

1. Create an advanced PowerShell analysis script:

# Advanced authentication package analysis
$StartDate = (Get-Date).AddDays(-30)
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4610; StartTime=$StartDate}

# Group by authentication package and analyze frequency
$PackageStats = $Events | ForEach-Object {
    $AuthPackage = ($_.Message -split '\n' | Where-Object {$_ -like '*Authentication Package Name:*'}) -replace '.*Authentication Package Name:\s*',''
    [PSCustomObject]@{
        Date = $_.TimeCreated.Date
        AuthPackage = $AuthPackage
        ProcessId = $_.ProcessId
    }
} | Group-Object AuthPackage | Select-Object Name, Count, @{Name='FirstSeen';Expression={($_.Group | Sort-Object Date)[0].Date}}, @{Name='LastSeen';Expression={($_.Group | Sort-Object Date)[-1].Date}}

$PackageStats | Format-Table -AutoSize

2. Check for suspicious authentication package installations:

# Look for recently installed authentication packages
$RecentInstalls = Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-7)} | Where-Object {$_.Message -like '*authentication*' -or $_.Message -like '*security*'}

$RecentInstalls | ForEach-Object {
    Write-Host "Service Installation: $($_.TimeCreated)" -ForegroundColor Yellow
    Write-Host $_.Message
    Write-Host "---"
}

3. Correlate with software installation events:

# Check Windows Installer logs for security-related installations
$InstallerEvents = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='MsiInstaller'; StartTime=(Get-Date).AddDays(-7)} | Where-Object {$_.Message -like '*security*' -or $_.Message -like '*authentication*'}

$InstallerEvents | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-List

4. Generate a comprehensive security report:

# Generate security report
$Report = @{
    GeneratedDate = Get-Date
    AuthenticationPackages = $PackageStats
    RecentServiceInstalls = $RecentInstalls.Count
    RecentSoftwareInstalls = $InstallerEvents.Count
    SystemUptime = (Get-Date) - (Get-CimInstance -ClassName Win32_OperatingSystem).LastBootUpTime
}

$Report | ConvertTo-Json -Depth 3 | Out-File "C:\Temp\AuthPackageSecurityReport_$(Get-Date -Format 'yyyyMMdd_HHmm').json"