T1547.005 — Security Support Provider

Tactics: Persistence, Privilege Escalation · Platforms: Windows

Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in…

Sub-technique of Boot or Logon Autostart Execution (T1547).

Sigma detection rules (1)

T1547.005 Boot or Logon Autostart Execution: Security Support Provider

title: "T1547.005 Boot or Logon Autostart Execution: Security Support Provider"
id: 9d13cf5b-fcec-4d9b-b3a1-dbbb5a8b90a8
description: 'Registry Monitoring for Security Support Provider Abuse via Control\Lsa\Security Packages Modification. (Data Component: Module Load; baseline tier: windows-eventid.) Tune using: TimeWindow, DLLSignatureValidation, CustomSSPNameList, BootContextCorrelation.'
references:
  - https://attack.mitre.org/techniques/T1547/005
author: Shahrukh Khan
date: 2026-04-11
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1547.005

logsource:
  category: registry_set
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '13'
    TargetObject|endswith:
      - '\Control\Lsa\Security Packages'
      - '\Control\Lsa\OSConfig\Security Packages'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Security software legitimately registering an additional SSP/AP package.

level: medium

Related sub-techniques

Explore