attack.t1547.005 | Detection.FYI

Security Support Provider (SSP) Added to LSA Configuration

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.005 ·
Share on:

Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.

Read More