One Day Sec

What are the three methods to add an SSP like mimilib.dll in Mimikatz?

Method 1 involves copying mimilib.dll to `C:\Windows\System32` and adding it to the registry key `HKLM\System\CurrentControlSet\Control\Lsa\Security Packages`, then rebooting. Method 2 uses the `AddSecurityPackage` API after registry modification, which loads the SSP immediately without reboot. Method 3 exploits RPC to force lsass to load the DLL without touching the registry or memory, offering stealth advantages as described in the Usage of SSP in Mimikatz article.
AddSecurityPackageRPCregistrymimilibpersistencecredential theft

Browse all Q&A →