t1547-005-security-support-provider

name	T1547.005_security-support-provider
description	Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1547.005","persistence","privilege-escalation","windows","sub-technique"]
technique_id	T1547.005
tactic	persistence
all_tactics	["persistence","privilege-escalation"]
platforms	["Windows"]
mitre_url	https://attack.mitre.org/techniques/T1547/005
tech_stack	["windows"]
cwe_ids	["CWE-276"]
chains_with	["T1547","T1547.001","T1547.002","T1547.003","T1547.004","T1547.006","T1547.007","T1547.008","T1547.009","T1547.010","T1547.012","T1547.013","T1547.014","T1547.015"]
prerequisites	["T1547"]
severity_boost	{"T1547":"Chain with T1547 for deeper attack path","T1547.001":"Chain with T1547.001 for deeper attack path","T1547.002":"Chain with T1547.002 for deeper attack path"}

T1547.005 Security Support Provider

Sub-technique of: T1547

High-Level Description

Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.

The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.

Kill Chain Phase

• Persistence (TA0003)
• Privilege Escalation (TA0004)

Platforms: Windows

What to Check

• Identify if Security Support Provider technique is applicable to target environment
• Check Windows systems for indicators of Security Support Provider
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Modify HKLM:\System\CurrentControlSet\Control\Lsa Security Support Provider configuration in registry

Add a value to a Windows registry Security Support Provider pointing to a payload .dll which will normally need to be copied in the system32 folder. A common DLL used with this techquite is the minilib.dll from mimikatz, see https://pentestlab.blog/2019/10/21/persistence-security-support-provider/

Supported Platforms: windows Elevation Required: Yes

$oldvalue = $(Get-ItemProperty HKLM:\System\CurrentControlSet\Control\Lsa -Name 'Security Packages' | Select-Object -ExpandProperty 'Security Packages');
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Lsa" -Name 'Security Packages old' -Value "$oldvalue";
$newvalue = "AtomicTest.dll";
Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name 'Security Packages' -Value $newvalue