Network Provider DLL Registered for Credential Capture

Darshan Thummar@Mighty

•updated Jun 11, 2026•1•0•5

This rule detects network traffic on port 445 (SMB) containing the strings "Network Providers" and "ProviderPath" (case-insensitive). This pattern is indicative of an attempt to register a malicious Network Provider DLL for credential capture, a technique used by adversaries to persist and steal credentials.