Skip to content
Threat Feed

Vendor

CheckPoint

1 brief RSS
medium advisory

Network Logon Provider Registry Modification

Adversaries may modify the network logon provider registry to register a rogue network logon provider module for persistence and credential access by intercepting authentication credentials in clear text during user logon.

Defender XDR +3 credential-access persistence registry-modification
2r 2t