HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\OrderHKLM\SYSTEM\CurrentControlSet\Services\<...>\NetworkProvider
| Criteria | Value |
|---|---|
| Permissions | Admin |
| Security context | System |
| Persistence type | Registry |
| Code type | DLL |
| Launch type | Any logon required |
| Impact | Non-destructive |
| OS Version | All OS versions |
| Dependencies | OS only |
| Toolset | Scriptable |
When user logs on, winlogon.exe launches the child mpnotify.exe process, which in turns loads Credential Manager DLLs specified in Registry.
To make it even funnier, the DLL obtains cleartext passwords.
https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy