Skip to main content

​
Overview

The SecurityPackages command enumerates available security packages (SSPs - Security Support Providers) using the EnumerateSecurityPackagesA() API. These packages provide authentication services and include Kerberos, NTLM, Negotiate, and others. Understanding available security packages helps assess authentication capabilities and potential attack vectors.

​
Syntax

Seatbelt.exe SecurityPackages
This command does not support remote execution.

​
Output

Returns security package information:
  • Package name
  • Comment/Description
  • Capabilities flags
  • Version
  • RPC ID
  • Maximum token size

​
Use Cases

  • Red Team
  • Blue Team
  • Identify available authentication packages
  • Determine SSP capabilities
  • Assess authentication protocol support
  • Plan credential access techniques

​
Example Output

====== SecurityPackages ======

Name        : Kerberos
Comment     : Microsoft Kerberos V1.0
Capabilities: 0x000F3BBF
Version     : 1
RPCID       : 16
MaxToken    : 48000

Name        : NTLM
Comment     : NTLM Security Package
Capabilities: 0x00082B37
Version     : 1
RPCID       : 10
MaxToken    : 2888

Name        : Negotiate
Comment     : Microsoft Package Negotiator
Capabilities: 0x000F3BBF
Version     : 1
RPCID       : 9
MaxToken    : 48000

​
Remote Execution

This command does NOT support remote execution.

​
Detection Considerations

Minimal detection risk - queries available security packages via API.