Cross-source coverage

T1547.005 / ATT&CK

Boot or Logon Autostart Execution: Security Support Provider

7 rules across 4 sources.

From MITRE ATT&CK 19.2

Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.

The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.

Platforms
Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmon

How MITRE says to detect it DET0542

Registry and LSASS Monitoring for Security Support Provider Abuse

Windows Analytic 1495

Monitor registry modifications to `HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages` or `...\OSConfig\Security Packages`, especially insertions of new DLL entries. Correlate this with subsequent DLL module loads into `lsass.exe`. Track unsigned or anomalous DLLs loading into LSASS using image load auditing. LSASS loads unsigned DLL due to AuditLevel=8 registry configuration or System reboot followed by DLL load into lsass.exe

  • WinEventLog:Security EventCode=4657
  • WinEventLog:Sysmon EventCode=7
  • WinEventLog:Sysmon EventCode=1

View on attack.mitre.org ↗

elastic/detection-rules

4 rules
Detection Severity Format
Mimikatz Memssp Log File Detected High Elastic TOML
Installation of Security Support Provider Medium Elastic TOML
Potential PowerShell HackTool Script by Function Names Medium Elastic TOML
Suspicious Module Loaded by LSASS Medium Elastic TOML

SigmaHQ/sigma

1 rule
Detection Severity Format
Security Support Provider (SSP) Added to LSA Configuration High Sigma

elastic/protections-artifacts

1 rule
Detection Severity Format
Suspicious Windows Authentication Registry Modification Undefined Elastic TOML

splunk/security_content

1 rule
Detection Severity Format
Windows Security Support Provider Reg Query Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.