T1556.008 — Network Provider DLL

Tactics: Defense Impairment, Persistence, Credential Access · Platforms: Windows

Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process. Network provider DLLs allow Windows to interface with specific network protocols and can also support add-on credential management functions.…

Sub-technique of Modify Authentication Process (T1556).

Sigma detection rules (1)

T1556.008 Modify Authentication Process: Network Provider DLL

title: "T1556.008 Modify Authentication Process: Network Provider DLL"
id: 88781992-6167-4372-9ec5-947bca130747
description: 'Detects registration of a malicious network provider DLL via NetworkProvider ProviderOrder or ProviderPath registry keys (NPPSpy-style attacks). (Data Component: Registry Modification; baseline tier: windows-eventid.) Tune using: MonitoredRegistryKeys, SuspiciousDLLPaths, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1556/008
author: Shahrukh Khan
date: 2026-05-23
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.008

logsource:
  category: registry_event
  product: windows
  service: sysmon

detection:
  selection_order:
    EventID: '13'
    TargetObject|contains: '\Control\NetworkProvider\Order'
  selection_provider_path:
    EventID: '13'
    TargetObject|contains: '\NetworkProvider\ProviderPath'
  condition: 1 of selection_*

falsepositives:
  - Legitimate installation of new VPN, smart card, or storage network providers.

level: medium

Related sub-techniques

Explore