Detect Network Provider DLL in Microsoft Sentinel
Adversaries may register malicious network provider DLLs to capture cleartext user credentials. Windows Winlogon sends credentials to mpnotify.exe during logon, which shares plaintext credentials with all registered credential managers via NPLogonNotify(). A malicious DLL registered as a network provider via HKLM\SYSTEM\CurrentControlSet\Services\<name>\NetworkProvider and HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order receives cleartext passwords every login. NPPSpy by Grzegorz Tworek is a PoC implementation. Attackers target servers and DCs with high logon frequency.
MITRE ATT&CK
- Technique
- T1556 Modify Authentication Process
- Sub-technique
- T1556.008 Network Provider DLL
- Canonical reference
- https://attack.mitre.org/techniques/T1556/008/
KQL Detection Query
let NetworkProviderRegistry = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has_any (
@"Control\NetworkProvider",
@"CurrentControlSet\Control\NetworkProvider",
@"Services\NetworkProvider"
)
| where RegistryValueName in~ ("Order", "Name", "ProviderPath") or RegistryKey has "NetworkProvider"
| project Timestamp, DeviceName, AccountName, ActionType, RegistryKey,
RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine;
let NewServiceDLL = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"CurrentControlSet\Services"
| where RegistryValueName in~ ("ProviderPath", "NetworkProvider")
| project Timestamp, DeviceName, AccountName, ActionType, RegistryKey,
RegistryValueName, RegistryValueData, InitiatingProcessFileName;
let NewDLLInSystem32 = DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath =~ @"C:\Windows\System32"
| where FileName endswith ".dll"
| where InitiatingProcessFileName !in~ (
"msiexec.exe", "wusa.exe", "TrustedInstaller.exe", "svchost.exe", "poqexec.exe"
)
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName,
InitiatingProcessCommandLine, SHA256;
union NetworkProviderRegistry, NewServiceDLL, NewDLLInSystem32
| sort by Timestamp descDetects malicious network provider DLL installation by monitoring registry keys under HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider (where provider order and names are stored) and new services with NetworkProvider entries. Also monitors for unexpected DLL creation in System32 by non-system processes as a secondary indicator.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate third-party network providers installed by enterprise software (e.g., Novell Client, VPN software, enterprise SSO solutions)
- Windows updates or service packs that modify NetworkProvider registry keys
- Corporate VPN clients or remote desktop software registering custom network providers
- Enterprise authentication middleware products that integrate with Windows logon via the Network Provider API
Other platforms for T1556.008
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate Current Network Providers
Expected signal: Sysmon Event ID 12 (Registry Key Opened) for the NetworkProvider\Order key. Security Event ID 4656/4663 if registry auditing is enabled on the key. Process creation event for reg.exe.
- Test 2Register a Test Network Provider (Non-Functional)
Expected signal: Sysmon Event ID 13 (Registry Value Set) for HKLM\SYSTEM\CurrentControlSet\Services\AtomicTestNPP\NetworkProvider\ProviderPath. Security Event ID 4657 if registry auditing is enabled. Process creation for reg.exe.
- Test 3Add Provider to NetworkProvider Order (Persistence Step)
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject=HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ProviderOrder, Details showing updated order including 'AtomicTestNPP'. Security Event ID 4657 for registry modification.
References (6)
- https://attack.mitre.org/techniques/T1556/008/
- https://www.huntress.com/blog/cleartext-shenanigans-gifting-user-passwords-to-adversaries-with-nppspy
- https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy
- https://learn.microsoft.com/en-us/windows/win32/secauthn/network-provider-api
- https://learn.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nplogonnotify
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1556.008/T1556.008.md
Unlock Pro Content
Get the full detection package for T1556.008 including response playbook, investigation guide, and atomic red team tests.