MITRE ATT&CKsub-technique

T1547.005 Security Support Provider

Published 2020-01-24 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Persistence, Privilege Escalation
Platforms
Windows
Version
1.1
Created
2020-01-24

Description

Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1547 Boot or Logon Autostart Execution technique

Tactic · MITRE ATT&CK (2)

  • TA0003 Persistence tactic
  • TA0004 Privilege Escalation tactic

Referenced by MITRE ATT&CK · mitigates (1)

  • M1025 Privileged Process Integrity mitigation

Referenced by MITRE ATT&CK · uses (3)

  • S0363 Empire software (tool)
  • S0194 PowerSploit software (tool)
  • S0002 Mimikatz software (tool)

Referenced by Compliance · mitigates (6)

  • CIS-2.6 Allowlist Authorized Libraries CIS Safeguard v8.1
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-SC-39 Process Isolation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References