TA0003 · PERSISTENCE
Security Support Provider
Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start.
Detect it with
Monitor the Registry for changes to the SSP Registry keys. Monitor the LSA process for DLL loads.
Why it matters on shift
Security Support Provider is one of the concrete ways adversaries achieve persistence. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After persistence, the next tactic is usually Privilege Escalation. Search your telemetry for the transition before closing the ticket.
Kill-chain context