Elastic medium stable eql

Installation of Security Support Provider

Identifies registry modifications related to the Windows Security Support Provider (SSP) configuration. Adversaries may abuse this to establish persistence in an environment.

View Source

Detection Logic

registry where host.os.type == "windows" and event.type == "change" and
  registry.value : "Security Packages" and
  registry.path : (
      "*\\SYSTEM\\*ControlSet*\\Control\\Lsa\\Security Packages",
      "*\\SYSTEM\\*ControlSet*\\Control\\Lsa\\OSConfig\\Security Packages"
  ) and
  not process.executable : (
        "C:\\Windows\\System32\\msiexec.exe",
        "C:\\Windows\\SysWOW64\\msiexec.exe",
        /* Crowdstrike specific exclusion as it uses NT Object paths */
        "\\Device\\HarddiskVolume*\\Windows\\System32\\msiexec.exe",
        "\\Device\\HarddiskVolume*\\Windows\\SysWOW64\\msiexec.exe"
  )

Field Validations

Loading…

Comments (0)

Loading comments...