Detecting Malicious Network Provider DLLs on Windows (T1556.008)

At every Windows logon, the credentials make a short trip that most people never think about. They pass to components called network providers. MITRE ATT&CK technique T1556.008, Network Provider DLL, covers registering a malicious one to capture cleartext credentials. The tactics are defense impairment, persistence and credential access, and the platform is Windows.

How the logon path works

Network provider DLLs let Windows interface with specific network protocols, and they can add credential management functions. MITRE walks through the sequence. During logon, Winlogon, the interactive logon module, sends credentials to the local mpnotify.exe process through RPC. mpnotify.exe then shares the credentials in cleartext with registered credential managers, to notify them that a logon is happening.

How attackers use it

An adversary can configure a malicious network provider DLL to receive credentials from mpnotify.exe. Once the DLL is installed as a credential manager through the registry, it can receive and save credentials every time a user logs on to a workstation or domain, through the NPLogonNotify() function.

MITRE notes that adversaries may plant the DLL on systems known for higher logon activity or administrator logons, such as servers and domain controllers. That is the same logic as any credential harvester: put the collector where the best credentials arrive.

Because the DLL is loaded through a normal registration path, it can look like any other provider unless you check what is registered.

How to detect it

MITRE lists no data sources, but the registration locations are stable and specific.

• Registry changes to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order, and new keys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<NetworkProviderName>\NetworkProvider with a ProviderPath value. Sysmon events 12 and 13 capture these.
• New DLL files in the system directory on servers and domain controllers.
• Image loads into mpnotify.exe, which Sysmon event 7 records, from DLLs that are not part of the standard operating system.
• Provider names in the order list that do not match installed software.

A provider list that differs between two otherwise identical servers is a good lead.

How to reduce the risk

MITRE lists three mitigations.

1. Restrict registry permissions. Disallow modification of sensitive keys such as HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order.
2. Audit. Periodically review the registry for new and unknown network provider DLLs under the ProviderPath location, and make sure only valid ones are registered. The names appear in the Order key and each should have a corresponding service entry.
3. Operating system configuration. Starting in Windows 11 22H2, the EnableMPRNotifications policy can be disabled through Group Policy or a configuration service provider, which prevents Winlogon from sending credentials to network providers.

The third item removes the data flow itself, so test it, since some legitimate software may depend on those notifications.

Check your own environment

:: List registered network providers in order
reg query "HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order" /v ProviderOrder

# For each provider name in the list, show its DLL path
$names = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order").ProviderOrder -split ','
foreach ($n in $names) {
  Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\$n\NetworkProvider" -ErrorAction SilentlyContinue |
    Select-Object @{n='Provider';e={$n}}, ProviderPath
}

Checklist:

• Every provider maps to software you can name.
• Every ProviderPath is in a protected system directory and the file is signed.
• Domain controllers and servers show the same providers as their build image.
• The registry key permissions allow only administrators and the system to write.

Quick check

Sources

• MITRE ATT&CK T1556.008 Network Provider DLL