{"id":"eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc","title":"Security Support Provider (SSP) Added to LSA Configuration","description":"Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.\n","author":"iwillkeepwatch","status":"test","level":"high","date":"2019-01-18","modified":"2026-03-30","tags":["attack.privilege-escalation","attack.persistence","attack.t1547.005"],"technique_ids":["T1547.005"],"logsource":{"category":"registry_event","product":"windows"},"falsepositives":["Unknown"],"references":["https://powersploit.readthedocs.io/en/latest/Persistence/Install-SSP/","https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Install-SSP.ps1#L157"],"source_path":"rules/windows/registry/registry_event/registry_event_ssp_added_lsa_config.yml","source_sha256":"7a8ba57884fbfd3c97cca4a63806a9ac5b5eb59bcacbeede6747e1f06fb098af","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_ssp_added_lsa_config.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Security Support Provider (SSP) Added to LSA Configuration\nid: eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc\nstatus: test\ndescription: |\n    Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.\nreferences:\n    - https://powersploit.readthedocs.io/en/latest/Persistence/Install-SSP/\n    - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Install-SSP.ps1#L157\nauthor: iwillkeepwatch\ndate: 2019-01-18\nmodified: 2026-03-30\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1547.005\nlogsource:\n    category: registry_event\n    product: windows\ndetection:\n    selection:\n        TargetObject|endswith:\n            - '\\Control\\Lsa\\Security Packages'\n            - '\\Control\\Lsa\\OSConfig\\Security Packages'\n    filter_main_msiexec:\n        Image:\n            - 'C:\\Windows\\system32\\msiexec.exe'\n            - 'C:\\Windows\\syswow64\\MsiExec.exe'\n    filter_main_image_null:\n        Image: null\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1547.005","id":"T1547.005","name":"Security Support Provider","page":"techniques/enterprise/T1547.005/"}],"data_path":"data/detection-rules/eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc.json","kind":"sigma"}