S1131 NPPSPY

toolEnterprise

platformsWindows

also known asNPPSPY

NPPSPY is an implementation of a theoretical mechanism first presented in 2004 for capturing credentials submitted to a Windows system via a rogue Network Provider API item. NPPSPY captures credentials following submission and writes them to a file on the victim system for follow-on exfiltration.

techniques used (7)

ATT&CK techniques this enables or maps to.

T1005Data from Local System
T1056Input Capture
T1112Modify Registry
T1119Automated Collection
T1552Unsecured Credentials
T1557Adversary-in-the-Middle
T1684.001Impersonation

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan