Windows Registry: New Security Support Provider (SSP) added to LSA configuration

title: "Windows Registry: New Security Support Provider (SSP) added to LSA configuration"
id: f0134d09-872c-432c-a6ee-1cb71eca6767
status: test
description: This rule flags registry writes that add a Security Support Provider entry under the LSA Security Packages locations. Adding an SSP can enable persistence and may allow attacker-controlled code paths to access credential material stored by the operating system. The detection relies on registry event telemetry that includes the written target path and the process image performing the change, excluding modifications made by msiexec.
references:
  - https://powersploit.readthedocs.io/en/latest/Persistence/Install-SSP/
  - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Install-SSP.ps1#L157
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_ssp_added_lsa_config.yml
author: iwillkeepwatch, Huntrule Team
date: 2019-01-18
modified: 2026-03-30
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.005
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    TargetObject|endswith:
      - \Control\Lsa\Security Packages
      - \Control\Lsa\OSConfig\Security Packages
  filter_main_msiexec:
    Image:
      - C:\Windows\system32\msiexec.exe
      - C:\Windows\syswow64\MsiExec.exe
  filter_main_image_null:
    Image: null
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc
    type: derived