Network provider DLL registered in the registry

1title: Network provider DLL registered in the registry2id: f83b287a-4df6-47ef-b348-01eb9bcc01a13status: experimental4description: |5  Registering a network provider is how NPPSPY-style credential capture is6  installed: mpnotify.exe hands every interactive and domain logon's cleartext7  password to each registered provider, so the registration itself is the8  earliest and cheapest thing to watch. Two writes make a provider real, and9  this rule is one selection for each. The first is `ProviderPath` under a10  service's `NetworkProvider` subkey, which names the DLL that will receive11  credentials — an event is kept only when the value written does not point into12  System32 or SysWOW64, because every provider Windows ships (ntlanman.dll,13  drprov.dll, davclnt.dll) lives there. The second is a write to `ProviderOrder`14  under `Control\NetworkProvider\Order` or its `HwOrder` twin, the ordered list a15  provider's service name has to be added to before Windows will load it; that16  leg carries no path to filter on, so it matches every rewrite of the list.17  This addresses MITRE's `MonitoredRegistryKeys` and `SuspiciousDLLPaths` knobs,18  populated here with the two key paths above and with System32/SysWOW64 as the19  expected-location set — MITRE names the knobs, the values are authored.20  Three limits are worth stating. A DLL dropped into System32 before it is21  registered defeats the path filter entirely, and is caught only if the22  operator also rewrites `ProviderOrder`; that is the main reason the order leg23  is kept despite being the noisier of the two. AN1598's other three arms are24  not attempted here — its Sysmon EventID 11 file-creation, EventID 7 module-load25  and EventID 10 process-access legs are separate log sources, and its26  `TimeWindow` knob asks for the registry write, the DLL creation and the27  subsequent load during logon to be correlated, which needs a cross-event join28  and a timeframe that Sigma models neither of. And this rule is written in the29  Sysmon EventID 13 vocabulary (`TargetObject`, `Details`), which is the30  vocabulary Sigma's `registry_set` category is shaped around; the brief maps31  Security EventID 4657 onto that category, but 4657 splits the key and the value32  name into `ObjectName` and `ObjectValueName` and carries the data in33  `ObjectValue`, so an estate collecting 4657 needs those fields mapped onto34  `TargetObject` and `Details` before this rule can match at all — turning on35  *Audit Registry* and the SACL will not by itself make it fire. On the Sysmon36  side, registry events are not collected by a bare Sysmon install and several37  widely used configurations filter the registry down to a short include list,38  so confirm `Control\NetworkProvider` and `Services\*\NetworkProvider` are in39  the running config before treating a quiet result as a clean one.40  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0580, not hand-written and not tested by its author. Any lab result is on this rule's own page.41references:42  - https://attack.mitre.org/techniques/T1556/00843  - https://attack.mitre.org/detectionstrategies/DET058044author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)45date: 2026-08-1646tags:47  - attack.credential-access48  - attack.defense-evasion49  - attack.persistence50  - attack.t1556.00851logsource:52  category: registry_set53  product: windows54detection:55  selection_provider_path:56    TargetObject|endswith: '\NetworkProvider\ProviderPath'57  filter_system_dll:58    Details|contains:59      - '\System32\'60      - '\SysWOW64\'61  selection_provider_order:62    TargetObject|endswith:63      - '\NetworkProvider\Order\ProviderOrder'64      - '\NetworkProvider\HwOrder\ProviderOrder'65  condition: (selection_provider_path and not filter_system_dll) or selection_provider_order66falsepositives:67  - "Installation and upgrade of software that ships its own network provider. VPN and remote-access clients, virtual desktop agents such as Citrix Workspace and VMware Horizon, DFS and network-drive tools, and older NetWare or Micro Focus clients all write a ProviderPath under Program Files and insert their service name into ProviderOrder. This is the loudest match this rule has, it arrives estate-wide in bursts during a deployment or an agent upgrade wave, and it is why the level sits at medium rather than high."68  - "Machine build, imaging and sysprep. A task sequence that installs the standard agent set rewrites ProviderOrder once per product per build, so every newly provisioned host produces several matches under a task-sequence process rather than an interactive shell."69  - "Windows feature and role changes that add or remove a provider, such as enabling or disabling the WebClient/WebDAV service or the Remote Desktop client components, which rewrite the order list without any DLL being introduced."70  - "Repair, reinstall and rollback flows for an already-installed client, including MSI self-repair and endpoint tooling that reasserts its configuration on a schedule, each of which rewrites the same values it wrote at install time."71level: medium