MITRE ATT&CKsoftware (tool)

S1131 NPPSPY

Published 2024-05-17 Modified 2024-10-28 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.0
Created
2024-05-17

Description

NPPSPY is an implementation of a theoretical mechanism first presented in 2004 for capturing credentials submitted to a Windows system via a rogue Network Provider API item. NPPSPY captures credentials following submission and writes them to a file on the victim system for follow-on exfiltration.

Related

Uses · MITRE ATT&CK (7)

  • T1684.001 Impersonation sub-technique
  • T1557 Adversary-in-the-Middle technique
  • T1552 Unsecured Credentials technique
  • T1005 Data from Local System technique
  • T1056 Input Capture technique
  • T1112 Modify Registry technique
  • T1119 Automated Collection technique

References