Winsock Providers

Layered service and namespace provider DLLs loaded into programs that use sockets.

Use it to find a provider DLL loaded into programs that use sockets, such as a layered one that can see their traffic.

SYSTEM
Persistence

What It Is

Winsock is the Windows interface that network programs use to communicate. Winsock 2 can load layered service providers, DLLs that add processing such as filtering between a program and the base TCP or UDP providers. It can also load namespace providers that resolve names through a service such as DNS. These installed providers form the Winsock catalogue under the WinSock2\Parameters key in HKLM SYSTEM, and layered service providers are deprecated from Windows 8 in favour of the Windows Filtering Platform.

What It Proves

A provider DLL registered in the Winsock catalogues is loaded into processes that use Windows sockets. A layered provider can see or change network traffic and persists across reboots.

What It Does Not Prove

Protocol entries are packed binary, so parse them with a tool, while namespace entries keep their DLL in a plain LibraryPath value. Security and VPN products add genuine providers, so judge by the DLL.

Where It Lives

Winsock Providers lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SYSTEM\ControlSet001\Services\WinSock2\Parameters

C:\Windows\System32\config\SYSTEM

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Winsock Providers, each with what it tells you
Registry Value	What It Tells You
`NameSpace_Catalog5\Catalog_Entries\000000000002\LibraryPath` `REG_SZ%SystemRoot%\System32\mswsock.dll`	The second namespace provider is the genuine mswsock.dll from System32, as plain text. A LibraryPath outside System32 is the signal to chase.
`NameSpace_Catalog5\Catalog_Entries\000000000003\LibraryPath` `REG_SZ%SystemRoot%\System32\winrnr.dll`	winrnr.dll, the LDAP namespace provider, is another built-in entry. These ship with Windows, so an unexpected provider DLL is what to chase.
`Protocol_Catalog9\Catalog_Entries\000000000001\PackedCatalogItem` `REG_BINARY25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73 74 65 6D 33 32 5C 6D 73 77 73 6F 63 6B 2E 64 6C 6C ...`	The first protocol entry begins with the mswsock.dll path in plain text, the base TCP provider. A layered provider shows its own DLL path here instead.

How to Read It

Open Protocol_Catalog9 and NameSpace_Catalog5 under the Winsock Parameters key. Read the DLL path at the start of each PackedCatalogItem, and LibraryPath for each namespace provider. A provider DLL outside System32, or an unexpected one, is the signal.

When Windows Writes It: When a provider is installed or removed.
Which Windows Versions: Windows XP to 11
Tools That Parse It: Autoruns, Registry Explorer, RECmd

Hunt It

Sees It DirectlyDeviceRegistryEvents

Microsoft does not say which keys Defender records, so confirm it records this one first. A hit shows the catalogue changed, so parse it to see which DLL.

KQLDefender XDR, Advanced hunting

// Writes to the Winsock cataloguesDeviceRegistryEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where RegistryKey has_any ("Protocol_Catalog9", "NameSpace_Catalog5")| project Timestamp, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Winsock Providers shows.

DLL Load, Sysmon Event 7Not in the RegistryShows the provider DLL loading into programs that use sockets.

Sources

The facts on this page come from these public pages, which say more on each point.