Detect Network Provider DLL in Elastic Security
Adversaries may register malicious network provider DLLs to capture cleartext user credentials. Windows Winlogon sends credentials to mpnotify.exe during logon, which shares plaintext credentials with all registered credential managers via NPLogonNotify(). A malicious DLL registered as a network provider via HKLM\SYSTEM\CurrentControlSet\Services\<name>\NetworkProvider and HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order receives cleartext passwords every login. NPPSpy by Grzegorz Tworek is a PoC implementation. Attackers target servers and DCs with high logon frequency.
MITRE ATT&CK
- Technique
- T1556 Modify Authentication Process
- Sub-technique
- T1556.008 Network Provider DLL
- Canonical reference
- https://attack.mitre.org/techniques/T1556/008/
Elastic Detection Query
any where
(
event.category == "registry" and
event.type in ("creation", "change") and
(
registry.key : ("*\\Control\\NetworkProvider*", "*\\CurrentControlSet\\Control\\NetworkProvider*") or
(
registry.key : "*\\Services\\*" and
registry.value : ("ProviderPath", "NetworkProvider")
)
)
) or
(
event.category == "file" and
event.type == "creation" and
file.path : "C:\\Windows\\System32\\*.dll" and
not process.name : (
"msiexec.exe", "wusa.exe", "TrustedInstaller.exe",
"svchost.exe", "poqexec.exe", "setup.exe"
)
)Detects Network Provider DLL registration (T1556.008) via two signals: (1) registry modifications to HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider or Services\*\NetworkProvider keys targeting Order, Name, or ProviderPath values — the mechanism used to register a credential-harvesting DLL; (2) unexpected DLL placement in C:\Windows\System32 by non-trusted installer processes. Together these cover both the staging and the registration phases of the attack.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate VPN clients (Cisco AnyConnect, Palo Alto GlobalProtect, Pulse Secure) that register their own network provider DLLs during installation or update cycles — these will modify NetworkProvider\Order and write a DLL to System32
- Windows servicing operations (Windows Update, DISM, component-based servicing) that adjust NetworkProvider ordering as part of cumulative updates or feature upgrades
- Enterprise endpoint security products, backup agents, or credential management tools (e.g., CyberArk, BeyondTrust) that install credential interception components as part of their privileged access management functionality
Other platforms for T1556.008
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate Current Network Providers
Expected signal: Sysmon Event ID 12 (Registry Key Opened) for the NetworkProvider\Order key. Security Event ID 4656/4663 if registry auditing is enabled on the key. Process creation event for reg.exe.
- Test 2Register a Test Network Provider (Non-Functional)
Expected signal: Sysmon Event ID 13 (Registry Value Set) for HKLM\SYSTEM\CurrentControlSet\Services\AtomicTestNPP\NetworkProvider\ProviderPath. Security Event ID 4657 if registry auditing is enabled. Process creation for reg.exe.
- Test 3Add Provider to NetworkProvider Order (Persistence Step)
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject=HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ProviderOrder, Details showing updated order including 'AtomicTestNPP'. Security Event ID 4657 for registry modification.
References (6)
- https://attack.mitre.org/techniques/T1556/008/
- https://www.huntress.com/blog/cleartext-shenanigans-gifting-user-passwords-to-adversaries-with-nppspy
- https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy
- https://learn.microsoft.com/en-us/windows/win32/secauthn/network-provider-api
- https://learn.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nplogonnotify
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1556.008/T1556.008.md
Unlock Pro Content
Get the full detection package for T1556.008 including response playbook, investigation guide, and atomic red team tests.