T1556.008: Network Provider DLL
Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process. Network provider DLLs allow Windows to interface with specific network protocols and can also support add-on credential management functions.[1] During the logon process, Winlogon (the interactive logon module) sends credentials to the local `mpnotify.exe` process via RPC. The `mpnotify.exe` process then shares the credentials in cleartext with registered credential managers when notifying that a logon event is happening.[2][3][4]
Adversaries can configure a malicious network provider DLL to receive credentials from `mpnotify.exe`.[5] Once installed as a credential manager (via the Registry), a malicious DLL can receive and save credentials each time a user logs onto a Windows workstation or domain via the `NPLogonNotify()` function.[4]
Adversaries may target planting malicious network provider DLLs on systems known to have increased logon activity and/or administrator logon activity, such as servers and domain controllers.[2]
Analyst context for executives and security teams
Network Provider DLL is a Windows authentication-process abuse technique where a malicious registered network provider/credential manager DLL can receive cleartext credentials during logon. The business issue is not just malware persistence; it is potential credential exposure at the point employees or administrators authenticate, especially on systems with frequent or privileged logons such as servers and domain controllers.
Executive priority
Prioritize this as an identity and Windows hardening risk. Leaders should ask whether sensitive Windows systems have controlled registry permissions, audited authentication-related configuration, and monitoring for unexpected network provider DLL registration. For incident response, the key decision value is whether a compromised host could have captured credentials after installation, which may require credential reset and scope decisions based on actual logon activity.
Technical view
This is a Windows sub-technique of Modify Authentication Process with persistence, credential-access, and defense-impairment relevance. Validate visibility into registry changes used to install network provider or credential manager DLLs, DLL presence and loading around logon activity, and logon events on high-value systems. ATT&CK provides no official detection text for this object, but the relationship to DET0580 indicates detection should focus on Network Provider DLL registration and credential capture behavior. Treat servers and domain controllers as higher-priority review targets because the ATT&CK description notes adversaries may target systems with increased or administrator logon activity.
Likely telemetry
- Windows registry auditing for network provider or credential manager registration changes
- File creation or modification telemetry for DLLs referenced by authentication-related registry configuration
- Process and module-load telemetry involving Windows logon-related components such as Winlogon and mpnotify.exe where available
- Windows logon events, especially privileged or administrator logons on servers and domain controllers
- Endpoint detection and response alerts or inventory showing newly registered or unusual credential-management components
Detection direction
- Baseline expected registered network provider and credential manager DLLs on Windows systems, then alert on additions or changes outside approved software deployment activity.
- Correlate suspicious registration changes with subsequent user or administrator logons to assess credential exposure window.
- Tune for legitimate enterprise software that registers network providers or credential managers to reduce false positives, but require change evidence and ownership for any exception.
- Prioritize high-value Windows assets with frequent privileged logons; lack of registry auditing or module-load visibility is a material blind spot.
- Use the related DET0580 detection strategy as the ATT&CK-supported direction, while validating locally because this object has no official detection section.
Mitigation priorities
- Restrict permissions on sensitive registry locations used for authentication-related provider registration, aligning with M1024 Restrict Registry Permissions.
- Harden Windows operating system configuration so unused or unnecessary authentication/provider features and components are minimized, aligning with M1028 Operating System Configuration.
- Implement and regularly review auditing for authentication configuration, registry changes, and high-value host logon activity, aligning with M1047 Audit.
- Maintain approved baselines for registered providers on servers and domain controllers, and investigate drift before relying on credential resets alone.
- During incident response, use host timeline and logon evidence to determine which accounts authenticated after suspicious registration and may need protective action.
Analyst notes and limits
The supplied ATT&CK object supports Windows-only coverage and ties the behavior to credential access, persistence, and defense impairment. The most important defensive question is whether the organization can prove who changed authentication-related registry configuration and which users logged on afterward.
MITRE did not provide an official detection narrative for this technique in the supplied fields. Specific registry paths, event IDs, vendor detections, exploitation frequency, and attribution are not included here and should be validated against local Windows baselines and telemetry.
Network Provider DLL
Adversaries may register malicious network provider dynamic link libraries (DLLs) to capture cleartext user credentials during the authentication process. Network provider DLLs allow Windows to interface with specific network protocols and can also support add-on credential management functions.[1] During the logon process, Winlogon (the interactive logon module) sends credentials to the local `mpnotify.exe` process via RPC. The `mpnotify.exe` process then shares the credentials in cleartext with registered credential managers when notifying that a logon event is happening.[2][3][4]
Adversaries can configure a malicious network provider DLL to receive credentials from `mpnotify.exe`.[5] Once installed as a credential manager (via the Registry), a malicious DLL can receive and save credentials each time a user logs onto a Windows workstation or domain via the `NPLogonNotify()` function.[4]
Adversaries may target planting malicious network provider DLLs on systems known to have increased logon activity and/or administrator logon activity, such as servers and domain controllers.[2]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1556 | Modify Authentication Process | This object subtechnique of Modify Authentication Process. |
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.0 | Current bundle | 3f8e03f99dfa… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Network Provider API
Microsoft. (2021, January 7). Network Provider API. Retrieved March 30, 2023.
Open source URL -
[2]
NPPSPY - Huntress
Dray Agha. (2022, August 16). Cleartext Shenanigans: Gifting User Passwords to Adversaries With NPPSPY. Retrieved March 30, 2023.
Open source URL -
[3]
NPPSPY Video
Grzegorz Tworek. (2021, December 14). How winlogon.exe shares the cleartext password with custom DLLs. Retrieved March 30, 2023.
Open source URL -
[4]
NPLogonNotify
Microsoft. (2021, October 21). NPLogonNotify function (npapi.h). Retrieved March 30, 2023.
Open source URL -
[5]
NPPSPY
Grzegorz Tworek. (2021, December 15). NPPSpy. Retrieved March 30, 2023.
Open source URL -
[6]
mitre-attack T1556.008Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.