Detect Network Provider DLL in CrowdStrike LogScale
Adversaries may register malicious network provider DLLs to capture cleartext user credentials. Windows Winlogon sends credentials to mpnotify.exe during logon, which shares plaintext credentials with all registered credential managers via NPLogonNotify(). A malicious DLL registered as a network provider via HKLM\SYSTEM\CurrentControlSet\Services\<name>\NetworkProvider and HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order receives cleartext passwords every login. NPPSpy by Grzegorz Tworek is a PoC implementation. Attackers target servers and DCs with high logon frequency.
MITRE ATT&CK
- Technique
- T1556 Modify Authentication Process
- Sub-technique
- T1556.008 Network Provider DLL
- Canonical reference
- https://attack.mitre.org/techniques/T1556/008/
LogScale Detection Query
// T1556.008 — Network Provider DLL: registry registration and DLL staging
// Branch 1: NetworkProvider registry key creation or value modification
#event_simpleName = /RegKeyCreate|RegKeyValueUpdate|RegGenericValueUpdate|AsepValueUpdate/
| TargetObjectName = /(?i)(\\Control\\NetworkProvider|\\CurrentControlSet\\Control\\NetworkProvider|\\Services\\[^\\]+\\NetworkProvider)/
| eval DetectionBranch = "Registry: NetworkProvider Key Modified"
| select([timestamp, ComputerName, UserName, DetectionBranch, TargetObjectName, TargetObjectValueData, ImageFileName, CommandLine, ContextProcessId])
union
// Branch 2: Unexpected DLL written to System32
#event_simpleName = NewExecutableWritten
| TargetFileName = /(?i)^C:\\Windows\\System32\\[^\\]+\.dll$/
| ImageFileName != /(?i)(\\msiexec\.exe|\\wusa\.exe|\\TrustedInstaller\.exe|\\svchost\.exe|\\poqexec\.exe)$/
| eval DetectionBranch = "File: Unexpected DLL Written to System32"
| select([timestamp, ComputerName, UserName, DetectionBranch, TargetFileName, ImageFileName, CommandLine, TargetProcessId])
| sort(field=timestamp, order=desc)CrowdStrike LogScale (Falcon CQL) detection for T1556.008 Network Provider DLL. Combines two detection branches via union: (1) Falcon registry telemetry events (RegKeyCreate, RegKeyValueUpdate, AsepValueUpdate) targeting NetworkProvider control and service keys — covering both the provider ordering manipulation and ProviderPath DLL path registration; (2) NewExecutableWritten events for DLLs written to System32 by processes not in the trusted installer allowlist. The union approach ensures correlation across both attack stages with a single query.
Data Sources
Required Tables
False Positives & Tuning
- VPN software installations and updates — Cisco AnyConnect, Palo Alto GlobalProtect, and Fortinet FortiClient all register as Windows network providers and write DLLs to System32, generating both registry and file events on install and upgrade
- Software deployment via SCCM, Intune, or Ansible that packages software containing network provider components — the wrapping deployment agent (not msiexec) will appear as the initiating process and bypass the installer exclusion list
- Windows OS in-place upgrades and servicing operations executed by setup.exe or Windows Update Agent components that rewrite and reregister network subsystem DLLs as part of authentication framework updates
Other platforms for T1556.008
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate Current Network Providers
Expected signal: Sysmon Event ID 12 (Registry Key Opened) for the NetworkProvider\Order key. Security Event ID 4656/4663 if registry auditing is enabled on the key. Process creation event for reg.exe.
- Test 2Register a Test Network Provider (Non-Functional)
Expected signal: Sysmon Event ID 13 (Registry Value Set) for HKLM\SYSTEM\CurrentControlSet\Services\AtomicTestNPP\NetworkProvider\ProviderPath. Security Event ID 4657 if registry auditing is enabled. Process creation for reg.exe.
- Test 3Add Provider to NetworkProvider Order (Persistence Step)
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject=HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ProviderOrder, Details showing updated order including 'AtomicTestNPP'. Security Event ID 4657 for registry modification.
References (6)
- https://attack.mitre.org/techniques/T1556/008/
- https://www.huntress.com/blog/cleartext-shenanigans-gifting-user-passwords-to-adversaries-with-nppspy
- https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy
- https://learn.microsoft.com/en-us/windows/win32/secauthn/network-provider-api
- https://learn.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nplogonnotify
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1556.008/T1556.008.md
Unlock Pro Content
Get the full detection package for T1556.008 including response playbook, investigation guide, and atomic red team tests.