Windows SecuritySystem

Event 4622: A security package has been loaded by the Local Security Authority.

A security package has been loaded by the Local Security Authority.

Technical Details

Windows Security Source

Event ID: 4622

Windows Security- System

Event Description

A security package has been loaded by the Local Security Authority.

Key Log Fields

Key log field information is not yet available for this event. Refer to official documentation for field details.

MITRE ATT&CK® Mapping (1)

T1547.005persistence, privilege-escalation
Security Support Provider

Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots. Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start. Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs. The SSP configuration is stored in two Registry keys: <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages</code> and <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages</code>. An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.(Citation: Graeber 2014)

Contents