EmpireS0363 ↗
Can enumerate Security Support Providers (SSPs) as well as utilize PowerSploit's Install-SSP and Invoke-Mimikatz to install malicious SSPs and log authentication events.1
tfMITRE ATT&CK sub-technique
Security Support Provider T1547.005
sub-technique of T1547 Boot or Logon Autostart Execution
- Tactics
- Persistence, Privilege Escalation
- Platform
- Windows
- Version
- 1.1
- Created
- 24 January 2020
- Last modified
- 24 October 2025
Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.3
Tools & malware57th pct
Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.2
Detection rules50th pct
Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.Security Support Provider MITRE reference T1547.005
57th pctamong all ATT&CK techniques for number of tools
3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
PowerSploitS0194 ↗
PowerSploit's Install-SSP Persistence module can be used to establish by installing a SSP DLL.12
MimikatzS0002 ↗
The Mimikatz credential dumper contains an implementation of an SSP.1
All 3 software entries for this technique
Offense vs defense T1547.005
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 1
first rule: 2019 Q1Security Support Provider detection strategy DET0542
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Registry and LSASS Monitoring for Security Support Provider Abuse
1 platform
AN1495 · Windows
Monitor registry modifications to HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages or ...\OSConfig\Security Packages, especially insertions of new DLL entries. Correlate this with subsequent DLL module loads into lsass.exe. Track unsigned or anomalous DLLs loading into LSASS using image load auditing. LSASS loads unsigned DLL due to AuditLevel=8 registry configuration or System reboot followed by DLL load into lsass.exe
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog:Sysmon | EventCode=7 |
| Process CreationDC0032 | WinEventLog:Sysmon | EventCode=1 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Security | EventCode=4657 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Controls how long after registry modification to expect a DLL load into LSASS (e.g., after reboot) |
| DLLSignatureValidation | Use to detect unsigned DLLs or those not matching known trusted publisher certificates |
| CustomSSPNameList | Define allowed SSP values for your org to reduce false positives |
| BootContextCorrelation | Whether detection should correlate boot-time registry and process events |
Windows 8.1, Windows Server 2012 R2, and later versions may make LSA run as a Protected Process Light (PPL) by setting the Registry key HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\RunAsPPL, which requires all SSP DLLs to be signed by Microsoft.
Tests2ExecutorsPowerShell 2Need elevation2 of 2Have prerequisites0Have cleanup2Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition