SOC Event Lookup
Event ID 4614LSAP3

Windows Event ID 4614: A notification package has been loaded by the SAM

Applicable version
Windows Server 2008 and later; Windows Vista and later
Last reviewed
2026-07-22

Quick summary

Windows Security Event ID 4614 records that the Security Account Manager loaded a notification package, which Microsoft describes as a password filter on modern Windows versions.

Technical Metadata

Technical metadata for Event ID 4614
Event ID4614
ProviderMicrosoft-Windows-Security-Auditing
ChannelSecurity
LevelInformation
MITRE ATT&CKTA0006 Credential Access / T1556.002 Modify Authentication Process: Password Filter DLL
Key fields to watchNotification Package Name, Registry source, Computer

Trigger Scenarios

The event is generated when SAM loads password-filter DLLs during system startup from the Notification Packages registry value.

Key Fields

Notification Package Name

The loaded notification package name. Microsoft shows WDIGEST as an example; any newly observed package must match an approved password-filter inventory.

Registry source

Microsoft documents HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages as the value used to load these DLLs. This is the persistence location behind malicious password filters.

Computer

The affected host. Domain controllers deserve priority because password filters are invoked when domain passwords are set or changed.

Threat Hunting Queries

Microsoft Sentinel KQL: Retrieve Windows Security Event ID 4614
SecurityEvent
| where EventID == 4614
| project TimeGenerated, Computer, Account, EventData
| order by TimeGenerated desc
Data source
Microsoft Sentinel SecurityEvent table
Assumptions
The Windows Security Events connector populates SecurityEvent. Map raw XML fields to the event-specific fields documented on this page.
Query reference
Splunk SPL: Retrieve Windows Security Event ID 4614
index=wineventlog source="WinEventLog:Security" EventCode=4614
| table _time, host, user, EventCode, Message
Data source
Splunk Windows Security event data
Assumptions
Index, source and field aliases vary by deployment. Apply event-specific field conditions after validating local extraction.
Cortex XQL: Retrieve Windows Security Event ID 4614
dataset = microsoft_windows_raw
| filter edr_event_id = 4614
Data source
Cortex XDR microsoft_windows_raw
Assumptions
The applicable Windows event channel is ingested into Cortex XDR. Inspect raw provider fields because parsed names vary by collection path.
Query reference
Sigma rule: Windows Security Event ID 4614
title: Windows Security Event ID 4614
status: experimental
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4614
    condition: selection
falsepositives:
    - Legitimate administrative or system activity
level: informational
Data source
Sigma Windows Security log source
Assumptions
This rule retrieves the event and is not a standalone malicious-behavior detection. Add the documented conditions and correlations in the destination SIEM.
Query reference

Documented Values and Codes

Documented event values and their security relevance
FieldValueMeaningSecurity relevance
NotificationPackageNameDLL nameThe SAM notification or password-filter package loaded by Windows.Interpret NotificationPackageName with the complete event and correlated activity; this value alone is not proof of compromise. Source
RegistryPathHKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification PackagesThe configuration location used to validate approved notification packages.Interpret RegistryPath with the complete event and correlated activity; this value alone is not proof of compromise. Source

MITRE ATT&CK Mapping

  • T1556.002Modify Authentication Process: Password Filter DLL

Detection Notes

T1556.002 is concrete when 4614 reports a Notification Package Name that was newly added to HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages. Microsoft states these packages are password filters loaded or called when passwords are set or changed, so a malicious package can observe password-change material; correlate with 4657 for the registry value write and with file telemetry for the corresponding DLL under C:\Windows\System32.

Common False Positives

  • Approved password-policy or identity-management software can install legitimate password filters.
  • Operating-system or security-product updates may reload existing packages at startup.

Related Events

Sample Log

Sanitized event sample
Notification Package Name: pfilter
Computer: DC01

Frequently Asked Questions

What does Windows Event ID 4614 mean?

A notification package was loaded by the Security Account Manager.

Does Event ID 4614 always indicate malicious activity?

No. Approved password filters and identity products can install notification packages.

How should Event ID 4614 be investigated?

Validate the package against the registry baseline, file path, signer and recent registry or file creation events.

Sources