What is SSP and how does Mimikatz use it to extract credentials?
SSP (Security Support Provider) is a DLL that handles authentication in Windows. Mimikatz uses its mimilib.dll as an SSP to hook the `SpAcceptCredentials` function, which captures plaintext passwords passed by LSA and saves them to a log file like `kiwissp.log`. This technique is similar to sekurlsa::wdigest but operates by registering a custom SSP rather than reading memory.
SSPSecurity Support ProvidermimilibSpAcceptCredentialsLSApassword extraction
Source:Usage of SSP in Mimikatz