Analytics BIOC Low

Uncommon Security Support Provider (SSP) registered via a registry key

Security Support Provider (SSP) exposes a number of callbacks to be invoked during certain authentication and authorization events. An attacker may register SSP to try and gain access to clear text passwords.

Module:
Platform Analytics
Data source:
XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Privilege Escalation (TA0004)
ATT&CK techniques: Boot or Logon Autostart Execution: Security Support Provider (T1547.005)
Attacker's goals:

Gain clear text passwords and persistency in the network.

Investigative actions:

Audit the specific key values to verify that the additional values are trusted.

Test period:
N/A (single event)
Deduplication:
1 Day