kevmap

TechniquesT1556.008 › AN1598

AN1598 Analytic 1598

Windows · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Detects registration of new or modified network provider DLLs via registry changes, anomalous file creation of DLLs in system directories, and suspicious process activity (mpnotify.exe interacting with non-standard DLLs). Multi-event correlation ties registry modification events to subsequent DLL loads during user logon activity.</p>
Detects
T1556.008 Network Provider DLL
Part of
DET0580 Detect Network Provider DLL Registration and Credential Capture

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
WinEventLog:SecurityEventCode=4657DC0063 Windows Registry Key Modification
WinEventLog:SysmonEventCode=11DC0039 File Creation
WinEventLog:SysmonEventCode=10DC0035 Process Access
WinEventLog:SysmonEventCode=7DC0016 Module Load

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
MonitoredRegistryKeysSpecific registry keys to monitor for DLL registration (e.g., NetworkProvider Order).
SuspiciousDLLPathsDirectories or file name patterns outside of normal system DLL locations.
TimeWindowWindow correlating registry modification, DLL creation, and subsequent logon activity.