{'created': '2023-03-30T22:45:00.431Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Adversaries may register malicious network provider dynamic '
                'link libraries (DLLs) to capture cleartext user credentials '
                'during the authentication process. Network provider DLLs '
                'allow Windows to interface with specific network protocols '
                'and can also support add-on credential management '
                'functions.(Citation: Network Provider API) During the logon '
                'process, Winlogon (the interactive logon module) sends '
                'credentials to the local `mpnotify.exe` process via RPC. The '
                '`mpnotify.exe` process then shares the credentials in '
                'cleartext with registered credential managers when notifying '
                'that a logon event is happening.(Citation: NPPSPY - '
                'Huntress)(Citation: NPPSPY Video)(Citation: NPLogonNotify) \n'
                '\n'
                'Adversaries can configure a malicious network provider DLL to '
                'receive credentials from `mpnotify.exe`.(Citation: NPPSPY) '
                'Once installed as a credential manager (via the Registry), a '
                'malicious DLL can receive and save credentials each time a '
                'user logs onto a Windows workstation or domain via the '
                '`NPLogonNotify()` function.(Citation: NPLogonNotify)\n'
                '\n'
                'Adversaries may target planting malicious network provider '
                'DLLs on systems known to have increased logon activity and/or '
                'administrator logon activity, such as servers and domain '
                'controllers.(Citation: NPPSPY - Huntress)',
 'external_references': [{'external_id': 'T1556.008',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1556/008'},
                         {'description': ' Dray Agha. (2022, August 16). '
                                         'Cleartext Shenanigans: Gifting User '
                                         'Passwords to Adversaries With '
                                         'NPPSPY. Retrieved March 30, 2023.',
                          'source_name': 'NPPSPY - Huntress',
                          'url': 'https://www.huntress.com/blog/cleartext-shenanigans-gifting-user-passwords-to-adversaries-with-nppspy'},
                         {'description': 'Grzegorz Tworek. (2021, December '
                                         '14). How winlogon.exe shares the '
                                         'cleartext password with custom DLLs. '
                                         'Retrieved March 30, 2023.',
                          'source_name': 'NPPSPY Video',
                          'url': 'https://www.youtube.com/watch?v=ggY3srD9dYs'},
                         {'description': 'Grzegorz Tworek. (2021, December '
                                         '15). NPPSpy. Retrieved March 30, '
                                         '2023.',
                          'source_name': 'NPPSPY',
                          'url': 'https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy'},
                         {'description': 'Microsoft. (2021, January 7). '
                                         'Network Provider API. Retrieved '
                                         'March 30, 2023.',
                          'source_name': 'Network Provider API',
                          'url': 'https://learn.microsoft.com/en-us/windows/win32/secauthn/network-provider-api'},
                         {'description': 'Microsoft. (2021, October 21). '
                                         'NPLogonNotify function (npapi.h). '
                                         'Retrieved March 30, 2023.',
                          'source_name': 'NPLogonNotify',
                          'url': 'https://learn.microsoft.com/en-us/windows/win32/api/npapi/nf-npapi-nplogonnotify'}],
 'id': 'attack-pattern--90c4a591-d02d-490b-92aa-619d9701ac04',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'credential-access'},
                       {'kill_chain_name': 'mitre-attack',
                        'phase_name': 'defense-evasion'},
                       {'kill_chain_name': 'mitre-attack',
                        'phase_name': 'persistence'}],
 'modified': '2025-04-15T22:51:56.379Z',
 'name': 'Network Provider DLL',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_contributors': ['CrowdStrike Falcon OverWatch', 'Jai Minton'],
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': True,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['Windows'],
 'x_mitre_version': '1.0'}