tool

NPPSPY S1131

Type: tool
Platform: Windows
Created: 17 May 2024
Last modified: 28 October 2024

NPPSPY is an implementation of a theoretical mechanism first presented in 2004 for capturing credentials submitted to a Windows system via a rogue Network Provider API item. NPPSPY captures credentials following submission and writes them to a file on the victim system for follow-on exfiltration.[1][2]

Techniques33rd pct

Tactics41st pct

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

NPPSPY MITRE reference S1131

Data from Local System T1005 ↗

NPPSPY records data entered from the local system logon at Winlogon to capture credentials in cleartext.3

Collection22 detection rules

Input Capture T1056 ↗

NPPSPY captures user input into the Winlogon process by redirecting RPC traffic from legitimate listening DLLs within the operating system to a newly registered malicious item that allows for recording logon information in cleartext.4

Credential Access · Collection2 detection rules

Modify Registry T1112 ↗

NPPSPY modifies the Registry to record the malicious listener for output from the Winlogon process.5

Persistence · Defense Impairment177 detection rules

Automated Collection T1119 ↗

NPPSPY collection is automatically recorded to a specified file on the victim machine.6

Collection11 detection rules

Unsecured Credentials T1552 ↗

NPPSPY captures credentials by recording them through an alternative network listener registered to the mpnotify.exe process, allowing for cleartext recording of logon information.7

Credential Access22 detection rules

Adversary-in-the-Middle T1557 ↗

NPPSPY opens a new network listener for the mpnotify.exe process that is typically contacted by the Winlogon process in Windows. A new, alternative RPC channel is set up with a malicious DLL recording plaintext credentials entered into Winlogon, effectively intercepting and redirecting the logon information.8

Credential Access · Collection12 detection rules

Standing S1131

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques733rd pct

33rd percentile · 67% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics541st pct

41st percentile · 59% of 825 ATT&CK software entries have more tactics spanned.

Threat groups061% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique12medBottom 22%

22nd percentile · 78% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique2medBottom 7%

7th percentile · 93% of 825 ATT&CK software entries have more atomic tests per technique.

Data comps / technique5med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique2medTop 9%

91st percentile · 91% of 825 ATT&CK software entries have this many mitigations per technique or fewer.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this tool’s 7 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 141Splunk ESCU (cumulative) · 103

Standing S1131

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups.	Hunting	test	file_access	windows	-	Persistence, Defense Impairment Modify Registry	-	low	frack113	2023-09-15	2024-07-29	337a31c6-46c4-46be-886a-260d7aa78cac
	Detect set Notification_Suppress to 1 to disable the Windows security center notification	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	0c93308a-3f1b-40a9-b649-57ea1a1c1d63
	Detect set DisallowRun to 1 to prevent user running specific computer program	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	275641a5-a492-45e2-a817-7c81e9d9d3e9
	Detects when a new owner is added to an application. (...)	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Credential Access Unsecured Credentials	-	medium	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-02	—	74298991-9fc4-460e-a92e-511aa60baec1
	Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...)	Generic	test	pipe_created	windows	Sysmon	Collection Data from Local System	-	medium	Roberto Rodriguez @Cyb3rWard0g	2021-10-08	2023-11-30	1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
	Detect enable rdp feature to allow specific user to rdp connect on the targeted machine	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	37b437cf-3fc5-4c8e-9c94-1d7c9aff842b
	Detects when a configuration change is made to an applications AppID URI.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Credential Access Unsecured Credentials Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-02	—	1b45b0d1-773f-4f23-aedc-814b759563b1
	Once established within a system or network, an adversary may use automated techniques for collecting internal data.	Generic	test	ps_script	windows	PowerShell	Collection Automated Collection	-	medium	frack113	2021-07-28	2022-12-25	c1dda054-d638-4c16-afc8-53e007f3fbc5
	Once established within a system or network, an adversary may use automated techniques for collecting internal data.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Automated Collection Credential Access Unsecured Credentials Credentials In Files	-	medium	frack113	2021-07-28	2022-11-11	f576a613-2392-4067-9d1a-9345fb58d8d1
	An attempt to export an AWS EC2 instance has been detected. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Collection Data from Local System Exfiltration Transfer Data to Cloud Account	-	low	Diogo Braz	2020-04-16	2022-10-05	54b9a76a-3c71-4673-b4b3-2edb4566ea7b
Splunk	The following analytic identifies anomalous GetObject API activity in AWS, indicating potential data exfiltration attempts. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Collection Automated Collection	-	medium	Bhavin Patel, Splunk	2023-04-10	2026-05-13	e4384bbf-5835-4831-8d85-694de6ad2cc6
Splunk	The following analytic identifies the creation of AWS Batch jobs that could potentially abuse the AWS Bucket Replication feature on S3 buckets. (...)	Generic	stable	scheduled_job	-	AWS CloudTrail · AWS	Collection Automated Collection	-	medium	Bhavin Patel, Splunk	2023-04-24	2026-05-13	04455dd3-ced7-480f-b8e6-5469b99e98e2
Splunk	The following analytic detects the creation of an AWS DataSync task, which could indicate potential data exfiltration. (...)	Generic	stable	scheduled_job	-	AWS CloudTrail · AWS	Collection Automated Collection	-	medium	Bhavin Patel, Splunk	2023-04-10	2026-05-13	05c4b09f-ea28-4c7c-a7aa-a246f665c8a2
	Identifies when a key vault is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Credential Access Unsecured Credentials Credentials In Files	-	medium	Austin Songer @austinsonger	2021-08-16	2022-08-23	459a2970-bb84-4e6a-a32e-ff0fbd99448d
	Identifies when a Keyvault Key is modified or deleted in Azure.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Credential Access Unsecured Credentials Credentials In Files	-	medium	Austin Songer @austinsonger	2021-08-16	2022-08-23	80eeab92-0979-4152-942d-96749e11df40
	Identifies when secrets are modified or deleted in Azure.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Credential Access Unsecured Credentials Credentials In Files	-	medium	Austin Songer @austinsonger	2021-08-16	2022-08-23	b831353c-1971-477b-abb6-2828edc3bca1
	Identifies when an admission controller is executed in Azure Kubernetes. (...)	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Credential Access Unsecured Credentials Container API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Austin Songer @austinsonger	2021-11-25	2022-12-18	a61a3c56-4ce2-4351-a079-88ae4cbd2b58
	Detects sign-in attempts in Azure/Entra ID logs where the user agent contains "axios", indicating po (...)	Hunting	experimental	authentication	-	Azure Sign-in Logs · Azure	Credential Access, Collection Adversary-in-the-Middle	-	low	Marco Pedrinazzi (@pedrinazziM) (InTheCyber)	2026-04-28	—	ea1a07f0-3dac-47a2-aeb4-86f5379ba2b4
	Detects specific windows registry modifications made by BlackByte ransomware variants. (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-01-24	2025-10-21	83314318-052a-4c90-a1ad-660ece38d276
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2022-10-09	c3198a27-23a0-4c2c-af19-e5328d49680e
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2023-08-17	92b0b372-a939-44ed-a11b-5136cf680e27
	Detect possible persistence using Fax DLL load when service restart	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-07-17	2022-12-30	9e3357ba-09d4-4fbd-a7c5-ad6386314513
	Detect change of the user account associated with the FAX service to avoid the escalation problem.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	high	frack113	2022-07-17	2022-12-30	e3fdf743-f05b-4051-990a-b66919be1743
Splunk	This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Cloud Storage Collection Data from Local System	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	4d7e8f3a-9c2b-4e6f-8a1d-5b9c7e2f4a8c
Splunk	This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration Exfiltration Over C2 Channel	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b
Splunk	This analytic detects execution of packet capture commands on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Credential Access, Collection Adversary-in-the-Middle Credential Access, Discovery Network Sniffing	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	7e9c3f8a-4b2d-4c5e-9a1f-6d8e5b3c2a9f
	Detects BGP failures which may be indicative of brute force attacks to manipulate routing	Generic	test	-	-	BGP · Cisco	Credential Access, Collection Adversary-in-the-Middle Credential Access Brute Force Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	low	Tim Brown	2023-01-09	2023-01-23	56fa3cd6-f8d6-4520-a8c7-607292971886
	Collect pertinent data from the configuration files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery Account Discovery Local Account Collection Data from Local System Credential Access Unsecured Credentials Credentials In Files	-	low	Austin Clark	2019-08-11	2023-01-04	cd072b25-a418-4f98-8ebc-5093fb38fe1a
	Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels	Generic	test	-	-	LDAP · Cisco	Credential Access, Collection Adversary-in-the-Middle Credential Access Brute Force Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	low	Tim Brown	2023-01-09	—	50e606bf-04ce-4ca7-9d54-3449494bbd4b
Splunk	This analytic detects changes to SNMP community strings on Cisco devices, which could indicate an attacker establishing persistence or attempting to extract credentials. (...)	Anomaly	stable	configuration_change	-	Cisco IOS · Cisco	Defense Impairment Disable or Modify Tools Credential Access, Discovery Network Sniffing Credential Access Unsecured Credentials	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	b0ce5521-2533-4f24-b8d5-c2ff977aae08
Splunk	This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. (...)	Generic	stable	configuration_change	-	Cisco IOS · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Web Service	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	1abce487-f480-4d5f-a551-01de0bece0bd
	Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	@SerkinValery, Nasreddine Bencherchali (Nextron Systems)	2023-06-12	2023-08-17	ac9159cc-c364-4304-8f0a-d63fc1a0aabb
	Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.	Generic	experimental	-	windows	WinEventLog System	Collection Data from Local System Credential Access OS Credential Dumping Security Account Manager	-	medium	Jason Mull	2025-05-12	—	882fbe50-d8d7-4e29-ae80-0648a8556866
	Detects disabling the CrashDump per registry (as used by HermeticWiper)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts Persistence, Defense Impairment Modify Registry	-	medium	Tobias Michalski (Nextron Systems)	2022-02-24	2023-08-17	2ff692c2-4594-41ec-8fcb-46587de769e0
	Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	CVE-2020-1048	high	EagleEye Team, Florian Roth (Nextron Systems), NVISO	2020-05-13	2024-03-25	7ec912f2-5175-4868-b811-ec13ad0f8567
Splunk	The following analytic detects AWS console login events by new users. (...)	Hunting	stable	authentication	-	AWS CloudTrail · AWS	Resource Development Compromise Accounts Cloud Accounts Credential Access Unsecured Credentials	-	medium	Rico Valdez, Splunk	2020-10-26	2026-05-13	bc91a8cd-35e7-4bb2-6140-e756cc46fd71	-
Splunk	The following analytic identifies the presence of unauthorized DHCP servers on the network. (...)	Generic	experimental	network_device	-	Cisco IOS · Cisco	Credential Access, Collection Adversary-in-the-Middle Initial Access Hardware Additions Impact Network Denial of Service	-	medium	Mikael Bjerkeland, Splunk	2020-08-11	2026-05-13	6e1ada88-7a0d-4ac1-92c6-03d354686079	-
	Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL Persistence, Defense Impairment Modify Registry	-	high	Dimitrios Slamaris	2017-05-15	2023-08-17	9d3436ef-9476-4c43-acca-90ce06bdf33a
	Detects registry modifications that change features of internal Windows tools (malware like Agent Te (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113, Nasreddine Bencherchali (Nextron Systems), CrimpSec	2022-03-18	2025-06-04	e2482f8d-3443-4237-b906-cc145d87a076
Splunk	The following analytic detects modifications to the Windows registry aimed at disabling the Registry Editor (regedit). (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-10-02	cd2cf33c-9201-11eb-a10a-acde48001122
	Detects the addition of a key 'MiniNt' to the registry. (...)	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence, Defense Impairment Modify Registry	-	high	Ilyas Ochkov, oscd.community	2019-10-25	2021-11-27	919f2ef0-be2d-4a7a-b635-eb2b41fde044
Splunk	The following analytic detects a suspicious registry modification aimed at disabling security audit logs by adding a specific registry entry. (...)	Generic	stable	registry_event	windows	Sysmon	Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-10-05	2026-05-13	39ebdc68-25b9-11ec-aec7-acde48001122
Splunk	The following analytic detects modifications to the Windows registry that disable the display of hidden files. (...)	Anomaly	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Stealth Hide Artifacts Hidden Files and Directories Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-05-13	6f3ccfa2-91fe-11eb-8f9b-acde48001122
Splunk	The following analytic detects a suspicious registry modification aimed at disabling Windows hotkeys for native applications. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-05-07	2026-05-13	1490f224-ad8b-11eb-8c4f-acde48001122
	Detect set UseActionCenterExperience to 0 to disable the Windows security center notification	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry	-	medium	frack113	2022-08-19	2023-08-17	3ae1a046-f7db-439d-b7ce-b8b366b81fa6
Splunk	The following analytic detects modifications to the registry that disable the CMD prompt application. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-10-02	ff86077c-9212-11eb-a1e6-acde48001122
Splunk	The following analytic detects registry modifications that disable the Control Panel on Windows systems. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-05-13	6ae0148e-9215-11eb-a94a-acde48001122
Splunk	The following analytic detects the modification of the Windows registry to disable the Run application in the Start menu. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment Modify Registry	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-03-31	2026-05-13	de81bc46-9213-11eb-adc9-acde48001122
	Detects DNS query requests to "update.onelaunch.com". (...)	Generic	test	dns	windows	Sysmon	Credential Access, Collection Input Capture	-	low	Josh Nickels	2024-02-26	—	df68f791-ad95-447f-a271-640a0dab9cf8
	Detects when a user enables DNS-over-HTTPS. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Persistence, Defense Impairment Modify Registry	-	medium	Austin Songer	2021-07-22	2023-08-17	04b45a8a-d11d-49e4-9acc-4a1b524407a5

Title

Description