Windows Event ID 5632 – LSA: Authentication Package Loaded

Start by examining the specific details of Event ID 5632 to understand which authentication package was loaded and the context.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → Security
3. Filter for Event ID 5632 by right-clicking the Security log and selecting Filter Current Log
4. Enter 5632 in the Event IDs field and click OK
5. Double-click on recent Event ID 5632 entries to view detailed information
6. Note the authentication package name, process ID, and timestamp
7. Check the Details tab for additional XML data including package-specific information

Use PowerShell to programmatically analyze Event ID 5632 occurrences and extract detailed information for further investigation.

1. Open PowerShell as Administrator
2. Query recent Event ID 5632 entries:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5632} -MaxEvents 50 | Select-Object TimeCreated, Id, LevelDisplayName, Message

3. Extract specific authentication package information:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5632} | ForEach-Object {
       $xml = [xml]$_.ToXml()
       [PSCustomObject]@{
           TimeCreated = $_.TimeCreated
           PackageName = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'AuthenticationPackageName'} | Select-Object -ExpandProperty '#text'
           ProcessId = $xml.Event.EventData.Data | Where-Object {$_.Name -eq 'ProcessId'} | Select-Object -ExpandProperty '#text'
       }
   }

4. Filter events from the last 24 hours:

   $StartTime = (Get-Date).AddDays(-1)
   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5632; StartTime=$StartTime}

5. Export results to CSV for analysis:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5632} -MaxEvents 100 | Export-Csv -Path "C:\Temp\Event5632_Analysis.csv" -NoTypeInformation

Investigate the registry locations where authentication packages are registered to understand the system's authentication configuration.

1. Open Registry Editor by pressing Win + R, typing regedit, and pressing Enter
2. Navigate to the LSA authentication packages registry key:
   HKLM\SYSTEM\CurrentControlSet\Control\Lsa
3. Examine the Authentication Packages value to see registered authentication providers
4. Check the Security Packages value for additional security providers
5. Review the Notification Packages value for password change notification DLLs
6. Use PowerShell to query registry values programmatically:

   Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "Authentication Packages"
   Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "Security Packages"

7. Compare current values with baseline configurations to identify unauthorized changes

Examine the actual authentication package DLL files to verify their legitimacy and identify potential security threats.

1. Identify authentication package file locations, typically in:
   C:\Windows\System32
2. Use PowerShell to list authentication-related DLLs:

   Get-ChildItem -Path "C:\Windows\System32" -Filter "*auth*.dll" | Select-Object Name, LastWriteTime, Length
   Get-ChildItem -Path "C:\Windows\System32" -Filter "*lsa*.dll" | Select-Object Name, LastWriteTime, Length

3. Check digital signatures of authentication packages:

   $AuthPackages = @("msv1_0.dll", "kerberos.dll", "ntlmssps.dll", "digest.dll")
   foreach ($package in $AuthPackages) {
       $file = Get-ChildItem -Path "C:\Windows\System32\$package" -ErrorAction SilentlyContinue
       if ($file) {
           $signature = Get-AuthenticodeSignature -FilePath $file.FullName
           Write-Output "$($file.Name): $($signature.Status) - $($signature.SignerCertificate.Subject)"
       }
   }

4. Use Windows Defender or third-party antivirus to scan authentication package files
5. Compare file hashes with known good baselines using:

   Get-FileHash -Path "C:\Windows\System32\msv1_0.dll" -Algorithm SHA256

6. Review file properties and version information for suspicious packages

Implement comprehensive monitoring for authentication package loading events to enhance security visibility and compliance.

1. Configure advanced audit policy for authentication events using Group Policy:
   Navigate to Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → System Audit Policies → Policy Change
2. Enable Audit Authentication Policy Change for Success and Failure events
3. Use PowerShell to configure audit policies programmatically:

   auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable
   auditpol /get /subcategory:"Authentication Policy Change"

4. Set up Windows Event Forwarding (WEF) to centralize Event ID 5632 collection:

   wecutil cs AuthPackageMonitoring.xml

5. Create custom event log queries for SIEM integration:

   $Query = @"
   
     
       *[System[EventID=5632]]
     
   
   "@
   Get-WinEvent -FilterXml $Query

6. Implement automated alerting for suspicious authentication package loading patterns
7. Document baseline authentication package configurations for change detection