Security Support Provider

let KnownSSPs = dynamic(["kerberos", "msv1_0", "schannel", "wdigest", "tspkg", "pku2u", "cloudAP", "negoexts", "wsauth", "livessp"]);
DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType == "RegistryValueSet"
| where RegistryKey has "\\Control\\Lsa" and RegistryValueName in~ ("Security Packages", "OSConfig\\Security Packages")
| mv-expand parse_json(RegistryValueData) to typeof(string)
| where not(RegistryValueData in~ (KnownSSPs))
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| sort by Timestamp desc

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
  (TargetObject="*\\Control\\Lsa\\Security Packages" OR TargetObject="*\\Control\\Lsa\\OSConfig\\Security Packages")
| table _time, host, TargetObject, Details, Image, User
| sort - _time

registry where event.type == "change" and
  registry.path : ("*\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Security Packages", "*\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\OSConfig\\Security Packages") and
  not registry.data.strings : ("kerberos", "msv1_0", "schannel", "wdigest", "tspkg", "pku2u", "cloudAP", "negoexts", "wsauth", "livessp", "") and
  registry.data.strings != null

SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') as event_time, logsourcename(logsourceid) as log_source, sourceip, username, "TargetObject", "Details", "Image"
FROM events
WHERE LOGSOURCETYPEID = 12 AND QIDNAME(qid) = 'Registry value set'
  AND ("TargetObject" ILIKE '%\\Control\\Lsa\\Security Packages' OR "TargetObject" ILIKE '%\\Control\\Lsa\\OSConfig\\Security Packages')
  AND "Details" NOT ILIKE '%kerberos%'
  AND "Details" NOT ILIKE '%msv1_0%'
  AND "Details" NOT ILIKE '%schannel%'
  AND "Details" NOT ILIKE '%wdigest%'
  AND "Details" NOT ILIKE '%tspkg%'
  AND "Details" NOT ILIKE '%pku2u%'
  AND "Details" NOT ILIKE '%cloudAP%'
  AND "Details" NOT ILIKE '%negoexts%'
  AND "Details" NOT ILIKE '%wsauth%'
  AND "Details" NOT ILIKE '%livessp%'
  AND LAST 24 HOURS
ORDER BY starttime DESC

_sourceCategory="windows/sysmon" EventCode=13
| where TargetObject matches "*\\Control\\Lsa\\Security Packages" or TargetObject matches "*\\Control\\Lsa\\OSConfig\\Security Packages"
| where !(Details matches "(?i)(kerberos|msv1_0|schannel|wdigest|tspkg|pku2u|cloudAP|negoexts|wsauth|livessp)")
| where Details != ""
| fields _messagetime, host, TargetObject, Details, Image, User
| sort by _messagetime desc

rule ssp_registry_modification_t1547_005 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects modification of LSA Security Packages registry keys to add non-standard SSP DLLs (MITRE ATT&CK T1547.005). Adversaries use this to load malicious DLLs into LSASS for credential access."
    severity = "HIGH"
    mitre_attack = "T1547.005"
    created = "2026-04-20"

  events:
    $e.metadata.event_type = "REGISTRY_MODIFICATION"
    (
      re.regex($e.target.registry.registry_key, `(?i)\\Control\\Lsa\\Security Packages$`) or
      re.regex($e.target.registry.registry_key, `(?i)\\Control\\Lsa\\OSConfig\\Security Packages$`)
    )
    not re.regex($e.target.registry.registry_value_data, `(?i)^(kerberos|msv1_0|schannel|wdigest|tspkg|pku2u|cloudAP|negoexts|wsauth|livessp|\s)*$`)
    $e.target.registry.registry_value_data != ""

  condition:
    $e
}

#event_simpleName=RegGenericValueUpdate
| RegKeyPath = /\\Control\\Lsa\\(OSConfig\\)?Security Packages/i
| RegStringValue != /(?i)(kerberos|msv1_0|schannel|wdigest|tspkg|pku2u|cloudAP|negoexts|wsauth|livessp)/
| RegStringValue != ""
| groupBy([ComputerName, UserName, RegKeyPath, RegStringValue, FileName, CommandLine], function=count(as=event_count))
| sort(field=@timestamp, order=desc)