
title: Security Support Provider (SSP) Added to LSA Configuration
author: iwillkeepwatch
date: 2019/01/18
description: Detects the addition of a SSP to the registry. Upon a reboot or API call,
  SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    TargetObject:
    - HKLM\System\CurrentControlSet\Control\Lsa\Security Packages
    - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Security Packages
  SELECTION_5:
    Image: C:\Windows\system32\msiexec.exe
  SELECTION_6:
    Image: C:\Windows\syswow64\MsiExec.exe
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and SELECTION_4 and  not
    (SELECTION_5 or SELECTION_6))
falsepositives:
- Unlikely
id: eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc
level: critical
logsource:
  category: registry_event
  product: windows
modified: 2020/09/06
references:
- https://attack.mitre.org/techniques/T1101/
- https://powersploit.readthedocs.io/en/latest/Persistence/Install-SSP/
status: experimental
tags:
- attack.persistence
- attack.t1101
- attack.t1547.005
ruletype: SIGMA
