SOC Event Lookup
Event ID 4610LSAP3

Windows Event ID 4610: An authentication package has been loaded by the LSA

Windows Security Event ID 4610 records that the Local Security Authority loaded an authentication package DLL.

Applicable version
Windows Server 2008 and later; Windows Vista and later
Last reviewed
2026-07-13

Trigger Scenarios

The event is generated each time the LSA loads authentication package DLLs during system startup from the Authentication Packages registry value.

Key Fields

Authentication Package Name

The loaded package in DLL_PATH_AND_NAME: AUTHENTICATION_PACKAGE_NAME format. Microsoft documents C:\Windows\system32\msv1_0.DLL : MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 as the only default Windows 10 package, so any other value must be baselined and justified.

Registry source

The packages are loaded from HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages. A new package in this value is the concrete persistence path behind ATT&CK T1547.002.

Computer

The host where LSASS loaded the package. A domain controller loading a non-baseline package has higher risk because it handles domain authentication.

Common False Positives

  • Credential provider, MFA, smart-card, or security software installation can legitimately register an authentication package.
  • Operating-system upgrades may reload or reinitialize default packages during boot.

Related Events

MITRE ATT&CK Mapping

  • T1547.002Boot or Logon Autostart Execution: Authentication Package

Detection Notes

Treat Authentication Package Name values other than C:\Windows\system32\msv1_0.DLL : MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 as T1547.002 candidates because Microsoft documents that value as the default Windows 10 authentication package. Correlate the 4610 with registry auditing on HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages and file creation or signing telemetry for the referenced DLL; a non-Microsoft DLL loaded by LSASS at boot gives persistence before user logon.

Microsoft Sentinel KQL
SecurityEvent
| where EventID == 4610
| where AuthenticationPackageName !contains "MICROSOFT_AUTHENTICATION_PACKAGE_V1_0"
| project TimeGenerated, Computer, AuthenticationPackageName
Splunk SPL
index=wineventlog EventCode=4610 NOT AuthenticationPackageName="*MICROSOFT_AUTHENTICATION_PACKAGE_V1_0*"
| table _time, host, AuthenticationPackageName
Sample Log
Authentication Package Name: C:\Windows\System32\evilap.dll : EVIL_AUTH_PACKAGE
Computer: DC01

Source

Official documentationMachine-readable JSON