ATT&CK technique
View on MITRE ATT&CK →
T1547.005
Security Support Provider
PersistencePrivilege Escalation
6 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Suspicious Module Loaded by LSASS | production | 2026-09-18 |
| elastic | Mimikatz Memssp Log File Detected | production | 2026-09-18 |
| elastic | Potential PowerShell HackTool Script by Function Names | production | 2026-09-18 |
| elastic | Installation of Security Support Provider | production | 2026-09-18 |
| splunk | Windows Security Support Provider Reg Query | production | 2026-05-13 |
| sigma | Security Support Provider (SSP) Added to LSA Configuration | test | 2026-03-30 |