Windows Registry: New Security Support Provider (SSP) added to LSA configuration
Alerts when a new SSP is added to LSA Security Packages in the Windows registry, excluding msiexec-driven changes.
- Product
- windows
- Category
- registry_event
- Author
- iwillkeepwatch (SigmaHQ), DRL 1.1
- Published
- 2019-01-18
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry writes that add a Security Support Provider entry under the LSA Security Packages locations. Adding an SSP can enable persistence and may allow attacker-controlled code paths to access credential material stored by the operating system. The detection relies on registry event telemetry that includes the written target path and the process image performing the change, excluding modifications made by msiexec.
Reporting behind it
- powersploit.readthedocs.iohttps://powersploit.readthedocs.io/en/latest/Persistence/Install-SSP/
- github.comhttps://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Install-SSP.ps1#L157
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_ssp_added_lsa_config.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: New Security Support Provider (SSP) added to LSA configuration"
id: f0134d09-872c-432c-a6ee-1cb71eca6767
status: test
description: This rule flags registry writes that add a Security Support Provider entry under the LSA Security Packages locations. Adding an SSP can enable persistence and may allow attacker-controlled code paths to access credential material stored by the operating system. The detection relies on registry event telemetry that includes the written target path and the process image performing the change, excluding modifications made by msiexec.
references:
- https://powersploit.readthedocs.io/en/latest/Persistence/Install-SSP/
- https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Install-SSP.ps1#L157
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_ssp_added_lsa_config.yml
author: iwillkeepwatch, Huntrule Team
date: 2019-01-18
modified: 2026-03-30
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547.005
logsource:
category: registry_event
product: windows
detection:
selection:
TargetObject|endswith:
- \Control\Lsa\Security Packages
- \Control\Lsa\OSConfig\Security Packages
filter_main_msiexec:
Image:
- C:\Windows\system32\msiexec.exe
- C:\Windows\syswow64\MsiExec.exe
filter_main_image_null:
Image: null
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc
type: derived