Security Support Provider (SSP) Added to LSA Configuration

SigmaHQ Detections@sigmaHQ

•updated Apr 1, 2026•0•0•0

Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.