Analytics BIOC
Low
✕
Uncommon Security Support Provider (SSP) registered via a registry key
Security Support Provider (SSP) exposes a number of callbacks to be invoked during certain authentication and authorization events. An attacker may register SSP to try and gain access to clear text passwords.
- Module:
- Platform Analytics
- Data source:
- XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Privilege Escalation (TA0004)
ATT&CK techniques: Boot or Logon Autostart Execution: Security Support Provider (T1547.005)
Attacker's goals:
Gain clear text passwords and persistency in the network.
Investigative actions:
Audit the specific key values to verify that the additional values are trusted.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day