1200KM / detection
T1556.008 Network Provider DLL — Detection Rules
Detection workspace for T1556.008 Network Provider DLL: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0580 Detect Network Provider DLL Registration and Credential Capture
AN1598 Analytic 1598
Detects registration of new or modified network provider DLLs via registry changes, anomalous file creation of DLLs in system directories, and suspicious process activity (mpnotify.exe interacting with non-standard DLLs). Multi-event correlation ties registry modification events to subsequent DLL loads during user logon activity.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1556.008 simulation workspace
- File Creation · DC0039
- Module Load · DC0016
- Process Access · DC0035
- Windows Registry Key Modification · DC0063
No reviewed association in this snapshot.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.