BIOC
Informational
✕
Security Support Provider (SSP) registered via a registry key
Security Support Provider (SSP) exposes a number of callbacks to be invoked during certain authentication and authorization events. An attacker may register SSP to try and gain access to clear text passwords.
- Module:
- Platform Analytics
- Agent event type:
- Registry
- Category:
- Privilege Escalation
- Status:
- Enabled
ATT&CK tactics: Privilege Escalation (TA0004)
ATT&CK techniques: Boot or Logon Autostart Execution: Security Support Provider (T1547.005)
Indicator:
Registry action type = create_registry_key , delete_registry_key , set_registry_value , delete_registry_value AND registry key name =~ .*HKEY_LOCAL_MACHINE\\SYSTEM\\(ControlSet00[1,2]|CurrentControlSet)\\Control\\Lsa.* AND registry value name =~ .*Security.* Host host os = windows
Preventable: yes