Network Logon Provider Registry Modification
Elastic Stack Serverless Security
Identifies the modification of the network logon provider registry. Adversaries may register a rogue network logon provider module for persistence and/or credential access via intercepting the authentication credentials in clear text during user logon.
Rule type: eql
Rule indices:
- logs-endpoint.events.*
- endgame-*
Severity: medium
Risk score: 47
Runs every: 5m
Searches indices from: now-9m (https://www.elastic.co/guide/en/elasticsearch/reference/current/common-options.html#date-math[Date Math format], see also Additional look-back time)
Maximum alerts per execution: 100
References:
- https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy
- https://docs.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nplogonnotify
Tags:
- Elastic
- Host
- Windows
- Threat Detection
- Persistence
- Credential Access
- Elastic Endgame
Version: 101
Rule authors:
- Elastic
Rule license: Elastic License v2
registry where registry.data.strings != null and
registry.path : (
"HKLM\\SYSTEM\\*ControlSet*\\Services\\*\\NetworkProvider\\ProviderPath",
"\\REGISTRY\\MACHINE\\SYSTEM\\*ControlSet*\\Services\\*\\NetworkProvider\\ProviderPath"
) and
/* Excluding default NetworkProviders RDPNP, LanmanWorkstation and webclient. */
not ( user.id : "S-1-5-18" and
registry.data.strings in
("%SystemRoot%\\System32\\ntlanman.dll",
"%SystemRoot%\\System32\\drprov.dll",
"%SystemRoot%\\System32\\davclnt.dll")
)
Framework: MITRE ATT&CKTM
Tactic:
- Name: Credential Access
- ID: TA0006
- Reference URL: https://attack.mitre.org/tactics/TA0006/
Technique:
- Name: Modify Authentication Process
- ID: T1556
- Reference URL: https://attack.mitre.org/techniques/T1556/
Tactic:
- Name: Persistence
- ID: TA0003
- Reference URL: https://attack.mitre.org/tactics/TA0003/
Technique:
- Name: Create or Modify System Process
- ID: T1543
- Reference URL: https://attack.mitre.org/techniques/T1543/