Full Report
We unravel an investigation that details one way threat actors are able to gather cleartext passwords via NPPSPY.
Analysis Summary
# Tool/Technique: NPPSPY
## Overview
NPPSPY is a post-exploitation technique and tool used to harvest cleartext credentials from Windows systems. It functions by registering a malicious Network Provider, which allows the attacker to "Man-in-the-Middle" (MitM) the Windows logon process. Unlike tools that dump credentials from memory (like Mimikatz), NPPSPY proactively captures passwords in real-time as users log in.
## Technical Details
- **Type:** Technique / Credential Stealer
- **Platform:** Windows
- **Capabilities:** Cleartext password capture, persistence via registry manipulation.
- **First Seen:** Publicly documented as a proof-of-concept (PoC) by Grzegorz Tworek; observed in the wild by Huntress in August 2022.
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- [T1003 - OS Credential Dumping]
- [T1556.008 - Modify Authentication Process: Network Provider DLL]
- **[TA0003 - Persistence]**
- [T1547.015 - Boot or Logon Autostart Execution: Network Provider]
## Functionality
### Core Capabilities
- **Network Provider Exploitation:** Exploits the way Windows handles multiple Network Providers. When a user logs in, `winlogon.exe` triggers `mpnotify.exe`, which passes credentials to registered Network Providers.
- **Cleartext Capture:** Intercepts the `NPLogonNotify` function call, which contains the username and password in cleartext before they are hashed.
- **Credential Logging:** Automatically writes captured credentials (Username, Domain, Password) to a local file for later retrieval by the attacker.
### Advanced Features
- **Stealthy Execution:** By masquerading as a legitimate system component (e.g., naming the malicious DLL `lsass.dll` or `nppspy.dll`), the tool can evade basic file-name-based detection.
- **Native Integration:** It utilizes the legitimate Windows Network Provider API, making the activity appear as standard system behavior to many security tools.
## Indicators of Compromise
- **File Hashes:** (Note: Hashes vary based on custom compilation of the PoC)
- **File Names:**
- `C:\Windows\System32\lsass.dll` (Observed in the wild)
- `C:\Windows\System32\nppspy.dll` (Default PoC name)
- `C:\NPPSPY.txt` (Default output file)
- **Registry Keys:**
- `HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order` (Value `ProviderOrder` appended with the malicious provider name)
- `HKLM\SYSTEM\CurrentControlSet\Services\[MaliciousServiceName]\NetworkProvider`
- **Behavioral Indicators:**
- Modification of the `ProviderOrder` registry key.
- Creation of a new service with a `NetworkProvider` subkey.
- `mpnotify.exe` loading an unsigned or unusual DLL from `System32`.
## Associated Threat Actors
- While the specific group in the Huntress report was not named, the technique is utilized by sophisticated actors seeking to maintain long-term access and move laterally using valid cleartext credentials.
## Detection Methods
- **Registry Monitoring:** Monitor for changes to `HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order`. Adding new, unauthorized providers is a high-fidelity alert.
- **Behavioral Detection:** Identify `mpnotify.exe` loading DLLs that are not part of the standard OS installation or lack valid digital signatures.
- **File Integrity Monitoring (FIM):** Monitor the `C:\Windows\System32\` directory for the creation of new DLLs that coincide with registry modifications.
- **YARA Rules:** Target the exports of the malicious DLL, specifically looking for the `NPLogonNotify` and `NPGetCaps` functions in non-standard files.
## Mitigation Strategies
- **Least Privilege:** Restrict administrative privileges to prevent the registry modifications required to install a Network Provider.
- **Credential Guard:** Enable Windows Defender Credential Guard to protect secrets, though NPPSPY targets the process prior to LSASS isolation.
- **Auditing:** Regularly audit the `ProviderOrder` registry key across the fleet to ensure only known-good providers (like `RDPNP`, `LanmanWorkstation`, and `webclient`) are present.
- **EDR/AV:** Use EDR solutions that alert on the registration of new system services and unsigned DLL loads by system processes.
## Related Tools/Techniques
- **WDigest:** Another technique used to force Windows to store cleartext passwords in memory.
- **Mimikatz:** Used for dumping credentials from LSASS memory.
- **Responder:** Used for capturing hashes over the network (LLMNR/NBT-NS poisoning).