> For the complete documentation index, see [llms.txt](https://tools.thehacker.recipes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://tools.thehacker.recipes/mimikatz/modules/misc/memssp.md).

# memssp

`misc::memssp` patches LSASS by injecting a new Security Support Provider (a DLL is registered). Then the credentials of all the users authenticating after the injection will be logged. It can also be utilised when [Credential Guard](https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard-manage) is configured.

{% hint style="info" %}
This command requires elevated privileges (by previously running [`privilege::debug`](/mimikatz/modules/privilege/debug.md) or by executing Mimikatz as the `NT-AUTHORITY\SYSTEM` account).
{% endhint %}

```
mimikatz # misc::memssp
Injected =)
```

If operating from a non-GUI session, then the following command can be used to lock the screen (the [`misc::lock`](/mimikatz/modules/misc/lock.md) can also be used):

```
rundll32.exe user32.dll,LockWorkStation
```

When a user authenticates again, the credentials will be saved to `C:\Windows\System32\mimilsa.log`.

![mimilsa.log](/files/Vw3WjHEi8Ge1iglIF3Fy)

{% hint style="info" %}
After rebooting the system, the SSP injection will be cleared.
{% endhint %}