Security Support Provider (SSP) Added to LSA Configuration

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•1•44

Detects the addition of a Security Support Provider (SSP) to the Windows registry. When an SSP DLL is loaded into the Local Security Authority (LSA) process, typically upon system reboot or via an API call, it gains access to encrypted and plaintext passwords stored in Windows. This technique is often used for persistence and credential access.