Security package (SSP) added (Reg via command)

title: Security package (SSP) added (Reg via command)
description: Detects scenarios where an attacker adds a reference in the registry to a malicious SSP (Security Support Provider). Note that this rule will not work with "in memory" SSP injection (Mimikatz).
references:
- https://twitter.com/JohnLaTwC/status/1417106953881497602?s=09
- https://blog.xpnsec.com/exploring-mimikatz-part-2/
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4622
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn408187(v=ws.11)?redirectedfrom=MSDN
- https://pentestlab.blog/2019/10/21/persistence-security-support-provider/
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/intercepting-logon-credentials-via-custom-security-support-provider-and-authentication-package
- https://securityintelligence.com/posts/hunting-evidence-dll-side-loading-powershell-sysmon/
- https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet#custom-ssp
- https://www.sentinelone.com/blog/how-attackers-exploit-security-support-provider-ssp-for-credential-dumping/
tags:
- attack.persistence
- attack.t1547.008
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:  # reg add "hklm\system\currentcontrolset\control\lsa\" /v "Security Packages" /d "kerberos\0msv1_0\0schannel\0wdigest\0tspkg\0pku2u\0mimilib" /t REG_MULTI_SZ
  selection:
    NewProcessName|endswith: '\reg.exe'
    CommandLine|contains|all:
      - 'REG ADD'
      - '\SYSTEM\CurrentControlSet\Control\Lsa'
      - 'Security Packages'
  condition: selection
falsepositives:
- None
level: high