mdecrevoisier high experimental sigma

Security package (SSP) loaded into LSA (native)

Detects scenarios where an attacker loads a malicious SSP (Security Support Provider) into the LSA process. Note that this rule will not work with "in memory" SSP injection (Mimikatz) as no event will be triggered.

View Source

Detection Logic

{
  "selection": {
    "EventID": 4622
  },
  "filter": {
    "SecurityPackageName
| contains": [
      "\\Windows\\system32\\cloudAP.dll",
      "\\Windows\\system32\\kerberos.dll",
      "\\Windows\\system32\\lsasrv.dll",
      "\\Windows\\system32\\msv1_0.dll",
      "\\Windows\\system32\\negoexts.dll",
      "\\Windows\\system32\\pku2u.dll",
      "\\Windows\\system32\\schannel.dll",
      "\\Windows\\system32\\tspkg.dll",
      "\\Windows\\system32\\wdigest.dll"
    ]
  },
  "condition": "selection and not filter"
}

False Positives

  • ⚠ None

Field Validations

Loading…

Comments (0)

Loading comments...