Network Logon Provider Registry Modificationedit

Identifies the modification of the network logon provider registry. Adversaries may register a rogue network logon provider module for persistence and/or credential access via intercepting the authentication credentials in clear text during user logon.

Rule type: eql

Rule indices:


Severity: medium

Risk score: 47

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100



  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Persistence
  • Credential Access

Version: 100 (version history)

Added (Elastic Stack release): 7.13.0

Last modified (Elastic Stack release): 8.5.0

Rule authors: Elastic

Rule license: Elastic License v2

Potential false positivesedit

Authorized third party network logon providers.

Rule queryedit

registry where != null and registry.path : "HKL
and /* Excluding default NetworkProviders RDPNP, LanmanWorkstation
and webclient. */ not ( : "S-1-5-18" and in
"%SystemRoot%\\System32\\davclnt.dll") )

Threat mappingedit


Rule version historyedit

Version 100 (8.5.0 release)
  • Formatting only
Version 4 (8.4.0 release)
  • Formatting only
Version 3 (8.2.0 release)
  • Formatting only
Version 2 (8.1.0 release)
  • Formatting only