Techniques › T1556 › T1556.008
T1556.008 Network Provider DLL
defense impairment · persistence · credential access — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
0
Sigma rules tagged attack.t1556.008
0
KEV CVEs mapped here
<p>Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process. Network provider DLLs allow Windows to interface with specific network protocols and can also support add-on credential management functions. During the logon process, Winlogon (the interactive logon module) sends credentials to the local
mpnotify.exe process via RPC. The mpnotify.exe process then shares the credentials in cleartext with registered credential managers when notifying that a logon event is happening.</p><p>Adversaries can configure a malicious network provider DLL to receive credentials from mpnotify.exe. Once installed as a credential manager (via the Registry), a malicious DLL can receive and save credentials each time a user logs onto a Windows workstation or domain via the NPLogonNotify() function.</p><p>Adversaries may target planting malicious network provider DLLs on systems known to have increased logon activity and/or administrator logon activity, such as servers and domain controllers.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0580 Detect Network Provider DLL Registration and Credential Capture v1.0
AN1598 WindowsDetects registration of new or modified network provider DLLs via registry changes, anomalous file creation of DLLs in system directories, and suspicious process activity (mpnotify.exe interacting with non-standard DLLs). Multi-event correlation ties registry modification events to subsequent DLL loads during user logon activity.Tunable:
MonitoredRegistryKeysSuspiciousDLLPathsTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1556.008
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1556) 12
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Corissa Koopmans, '@corissalea'
· 2022-07-19 · logsource: product=azure service=auditlogs · 26e7c5e2-6545-481e-b7e6-050143459635
Monitor and alert on conditional access changes where non approved actor removed CA Policy.
Author: Harjot Shah Singh, '@cyb3rjy0t'
· 2024-03-26 · logsource: product=azure service=auditlogs · 4bb80281-3756-4ec8-a88e-523c5a6fda9e
Detects newly added root certificate authority to an AzureAD tenant to support certificate based authentication.
Author: AlertIQ
· 2021-10-10 (modified 2022-12-25) · logsource: product=azure service=auditlogs · 4d78a000-ab52-4564-88a5-7ab5242b20c7
Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.
Author: Corissa Koopmans, '@corissalea'
· 2022-07-19 (modified 2024-05-28) · logsource: product=azure service=auditlogs · 50a3c7aa-ec29-44a4-92c1-fce229eef6fc
Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.
Author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'
· 2022-08-04 · logsource: product=azure service=auditlogs · 665e2d43-70dc-4ccc-9d27-026c9dd7ed9c
Monitor and alert on group membership removal of groups that have CA policy modification access
Author: @ionsor
· 2022-02-08 (modified 2026-04-30) · logsource: product=azure service=auditlogs · 7ea78478-a4f9-42a6-9dcd-f861816122bf
Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.
Author: Muhammad Faisal (@faisalusuf)
· 2023-01-29 (modified 2024-07-22) · logsource: product=github service=audit · 8622c92d-c00e-463c-b09d-fd06166f6794
Detects when a user disables a critical security feature for an organization.
Author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'
· 2022-08-04 · logsource: product=azure service=auditlogs · 91c95675-1f27-46d0-bead-d1ae96b97cd3
Monitor and alert on group membership additions of groups that have CA policy modification access
Author: Nischal Khadgi
· 2024-07-11 · logsource: product=windows category=registry_set · b61e87c0-50db-4b2e-8986-6a2be94b33b0
Detects changes to "DsrmAdminLogonBehavior" registry value.
During a Domain Controller (DC) promotion, administrators create a Directory Services Restore Mode (DSRM) local administrator account with a password that rarely changes. The DSRM account is an “Administrator” account that logs in with the DSRM mode when the server is booting up to restore AD backups or recover the server from a failure.
Attackers could abuse DSRM account to maintain their persistence and access to the organization's Active Directory.
If the "DsrmAdminLogonBehavior" value is set to "0", the administrator account can only be used if the DC starts in DSRM.
If the "DsrmAdminLogonBehavior" value is set to "1", the administrator account can only be used if the local AD DS service is stopped.
If the "DsrmAdminLogonBehavior" value is set to "2", the administrator account can always be used.
Author: Harjot Shah Singh, '@cyb3rjy0t'
· 2024-03-26 · logsource: product=azure service=auditlogs · c2496b41-16a9-4016-a776-b23f8910dc58
Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.
Author: Michael McIntyre @wtfender
· 2023-09-27 · logsource: product=aws service=cloudtrail · d3adb3ef-b7e7-4003-9092-1924c797db35
Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider.
A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation.
Author: Nasreddine Bencherchali (Nextron Systems), Elastic (idea)
· 2022-10-17 · logsource: product=windows service=security · f598ea0c-c25a-4f72-a219-50c44411c791
Detects possible addition of shadow credentials to an active directory object.