NPPSPY
- ID
- S1131
- Type
- Tool
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 29 Oct 2024
NPPSPY is an implementation of a theoretical mechanism first presented in 2004 for capturing credentials submitted to a Windows system via a rogue Network Provider API item. NPPSPY captures credentials following submission and writes them to a file on the victim system for follow-on exfiltration.[1][2]
Techniques used (7)
- T1005 Data from Local System
- T1056 Input Capture
- T1112 Modify Registry
- T1119 Automated Collection
- T1552 Unsecured Credentials
- T1557 Adversary-in-the-Middle
- T1684.001 Impersonation