Security Support Provider DLL Registered

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects network traffic on TCP port 445 (SMB) containing the string "Security Packages" in a case-insensitive manner. This pattern is often associated with the registration or use of Security Support Provider DLLs, which can be a persistence mechanism (T1547.005) used by adversaries to maintain access to a system.