SOC Event Lookup
Event ID 4610LSAP3

Windows Event ID 4610: An authentication package has been loaded by the LSA

Applicable version
Windows Server 2008 and later; Windows Vista and later
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 4610 records that the Local Security Authority loaded an authentication package DLL.

Technical Metadata

Technical metadata for Event ID 4610
Event ID4610
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
MITRE ATT&CKTA0003 Persistence / T1547.002 Boot or Logon Autostart Execution: Authentication Package
Key fields to watchAuthentication Package Name, Registry source, Computer

Trigger Scenarios

The event is generated each time the LSA loads authentication package DLLs during system startup from the Authentication Packages registry value.

Key Fields

Authentication Package Name

The loaded package in DLL_PATH_AND_NAME: AUTHENTICATION_PACKAGE_NAME format. Microsoft documents C:\Windows\system32\msv1_0.DLL : MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 as the only default Windows 10 package, so any other value must be baselined and justified.

Registry source

The packages are loaded from HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages. A new package in this value is the concrete persistence path behind ATT&CK T1547.002.

Computer

The host where LSASS loaded the package. A domain controller loading a non-baseline package has higher risk because it handles domain authentication.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 4610
SecurityEvent
| where EventID == 4610
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields documented on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 4610
index=wineventlog source="WinEventLog:Security" EventCode=4610
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source and field aliases vary by deployment. Apply event-specific field conditions after validating local extraction.
Cortex XQL: Retrieve Windows Security Event ID 4610
dataset = microsoft_windows_raw
| filter edr_event_id = 4610
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4610
title: Windows Security Event ID 4610
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4610
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
AuthenticationPackageNamemsv1_0Microsoft documents MSV1_0 as a standard Windows authentication package.Interpret AuthenticationPackageName with the complete event and correlated activity; this value alone is not proof of compromise. Source
RegistryPathHKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication PackagesThe LSA configuration location used to validate approved packages.Interpret RegistryPath with the complete event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1547.002Boot or Logon Autostart Execution: Authentication Package

Detection Notes

Treat Authentication Package Name values other than C:\Windows\system32\msv1_0.DLL : MICROSOFT_AUTHENTICATION_PACKAGE_V1_0 as T1547.002 candidates because Microsoft documents that value as the default Windows 10 authentication package. Correlate the 4610 with registry auditing on HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages and file creation or signing telemetry for the referenced DLL; a non-Microsoft DLL loaded by LSASS at boot gives persistence before user logon.

Common False Positives

  • Credential provider, MFA, smart-card, or security software installation can legitimately register an authentication package.
  • Operating-system upgrades may reload or reinitialize default packages during boot.

Related Events

Sample Log

Sanitized event sample
Authentication Package Name: C:\Windows\System32\evilap.dll : EVIL_AUTH_PACKAGE
Computer: DC01

Frequently Asked Questions

What does Windows Event ID 4610 mean?

An authentication package was loaded by the Local Security Authority.

Does Event ID 4610 always indicate malicious activity?

No. Standard Microsoft authentication packages load during normal startup.

How should Event ID 4610 be investigated?

Validate package name, path, signer and registry configuration, then correlate new DLL and registry activity.

Sources