Stealing Credentials with a Security Support Provider (SSP)
Tags
attack-pattern: Data Credentials - T1589.001 Domains - T1583.001 Domains - T1584.001 Powershell - T1059.001 Security Support Provider - T1547.005 Server - T1583.004 Server - T1584.004 Sharepoint - T1213.002 Software - T1592.002 Dcshadow - T1207 Powershell - T1086 Security Support Provider - T1101
Show in Graph
Common Information
Type Value
UUID bde8b549-055c-493f-9ed2-679b46be5bbe
Fingerprint 91910d0008e1ee6e
Analysis status DONE
Considered CTI value 0
Text language
Published July 11, 2017, 1:04 p.m.
Added to db Jan. 18, 2023, 8:53 p.m.
Last updated Sept. 4, 2024, 1:49 a.m.
Headline Stealing Credentials with a Security Support Provider (SSP)
Title Stealing Credentials with a Security Support Provider (SSP)
Detected Hints/Tags/Attributes 41/1/2
Source URLs
Redirection Url
Details Source https://blog.stealthbits.com/stealing-credentials-with-a-security-support-provider-ssp/
URL Provider
Details Provider Source level domain
Details stealthbits.com blog.stealthbits.com
Attributes
Details Type #Events CTI Value
Details File 1 
windowssystem32mimilsa.log
Details File 3 
mimilsa.log