Detect Network Provider DLL in Sumo Logic CSE
Adversaries may register malicious network provider DLLs to capture cleartext user credentials. Windows Winlogon sends credentials to mpnotify.exe during logon, which shares plaintext credentials with all registered credential managers via NPLogonNotify(). A malicious DLL registered as a network provider via HKLM\SYSTEM\CurrentControlSet\Services\<name>\NetworkProvider and HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order receives cleartext passwords every login. NPPSpy by Grzegorz Tworek is a PoC implementation. Attackers target servers and DCs with high logon frequency.
MITRE ATT&CK
- Technique
- T1556 Modify Authentication Process
- Sub-technique
- T1556.008 Network Provider DLL
- Canonical reference
- https://attack.mitre.org/techniques/T1556/008/
Sumo Detection Query
(_sourceCategory=*windows*sysmon* OR _sourceCategory=*sysmon*)
| where EventCode in ("12", "13", "14", "11")
| where
(
EventCode in ("12", "13", "14")
and (
TargetObject matches "*\\Control\\NetworkProvider*"
or TargetObject matches "*\\CurrentControlSet\\Control\\NetworkProvider*"
or (TargetObject matches "*\\Services\\*" and TargetObject matches "*NetworkProvider*")
)
)
or
(
EventCode = "11"
and TargetFilename matches "*\\Windows\\System32\\*.dll"
and !(Image matches "*\\msiexec.exe")
and !(Image matches "*\\wusa.exe")
and !(Image matches "*\\TrustedInstaller.exe")
and !(Image matches "*\\svchost.exe")
and !(Image matches "*\\poqexec.exe")
)
| eval EventType = if(EventCode="11", "DLL Written to System32",
if(EventCode="12", "Registry Key Created",
if(EventCode="13", "Registry Value Set",
if(EventCode="14", "Registry Object Deleted", "Unknown"))))
| eval ArtifactPath = if(EventCode="11", TargetFilename, TargetObject)
| eval AlertSeverity = if(EventCode in ("12","13") and ArtifactPath matches "*ProviderPath*", "CRITICAL",
if(EventCode in ("12","13") and ArtifactPath matches "*Order*", "HIGH", "MEDIUM"))
| table _time, Computer, User, EventType, AlertSeverity, ArtifactPath, Details, Image
| sort - _timeSumo Logic detection for T1556.008 Network Provider DLL. Queries Sysmon operational events for registry modifications (12/13/14) to NetworkProvider control keys and file creation events (11) for unexpected DLLs written to System32. Includes severity enrichment: ProviderPath modifications are most critical as they directly point to the malicious DLL path, Order modifications indicate provider ordering changes, and System32 DLL drops may be the staging step.
Data Sources
Required Tables
False Positives & Tuning
- Enterprise VPN clients (Cisco AnyConnect, Palo Alto GlobalProtect, Pulse Secure) that register their network credential provider DLL under NetworkProvider\Order and write associated DLLs to System32 during installation
- Microsoft Windows Update and cumulative patches modifying NetworkProvider order registry keys as part of authentication subsystem updates — particularly prevalent after major Windows feature updates
- Legitimate credential management or privileged access management (PAM) solutions such as CyberArk, BeyondTrust, or Thycotic that install credential interception hooks as network providers to enable session recording or credential vaulting
Other platforms for T1556.008
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate Current Network Providers
Expected signal: Sysmon Event ID 12 (Registry Key Opened) for the NetworkProvider\Order key. Security Event ID 4656/4663 if registry auditing is enabled on the key. Process creation event for reg.exe.
- Test 2Register a Test Network Provider (Non-Functional)
Expected signal: Sysmon Event ID 13 (Registry Value Set) for HKLM\SYSTEM\CurrentControlSet\Services\AtomicTestNPP\NetworkProvider\ProviderPath. Security Event ID 4657 if registry auditing is enabled. Process creation for reg.exe.
- Test 3Add Provider to NetworkProvider Order (Persistence Step)
Expected signal: Sysmon Event ID 13 (Registry Value Set): TargetObject=HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order\ProviderOrder, Details showing updated order including 'AtomicTestNPP'. Security Event ID 4657 for registry modification.
References (6)
- https://attack.mitre.org/techniques/T1556/008/
- https://www.huntress.com/blog/cleartext-shenanigans-gifting-user-passwords-to-adversaries-with-nppspy
- https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy
- https://learn.microsoft.com/en-us/windows/win32/secauthn/network-provider-api
- https://learn.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nplogonnotify
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1556.008/T1556.008.md
Unlock Pro Content
Get the full detection package for T1556.008 including response playbook, investigation guide, and atomic red team tests.