BIOC
Informational
✕
Tampering with Windows Security Support Provider DLLs
Windows Security Support Provider (SSP) DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored on Windows, such as any logged-on user's Domain password etc. CurrentControlSet is replaced with * because it can be replaced with ControlSet001 or ControlSet002.
- Module:
- Platform Analytics
- Agent event type:
- Registry
- Category:
- Persistence
- Status:
- Enabled
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Boot or Logon Autostart Execution: Security Support Provider (T1547.005)
Indicator:
Registry action type = all AND registry key name = *\SYSTEM\*ControlSet*\Control\Lsa\OSConfig , *\SYSTEM\*ControlSet*\Control\Lsa AND registry value name = *Security Packages* Host host os = windows
Preventable: yes