Query: Sigma rule for Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the
Matching passage: Sigma rule: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the. Logsource: windows / registry_set. Rule: title: Potential Credential Dumping Attempt Using New NetworkProvider - REG id: 0442defa-b4a2-41c9-ae2c-ea7042fc4701 related: - id: baef1ec6-2ca9-47a3-97cc-4cf2bda10b77 type: similar status: test description: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it references: - https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade - https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-23 modified: 2023-08-17 tags: - attack.credential-access - attack.t1003 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \System\CurrentControlSet\Services\ - \NetworkProvider filter: TargetObject|contains: - \System\CurrentControlSet\Services\WebClient\NetworkProvider - \System\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider - \System\CurrentControlSet\Services\RDPNP\NetworkProvider filter_valid_procs: Image: C:\Windows\System32\poqexec.exe condition: selection and not 1 of filter* falsepositives: - Other legitimate network providers used and not filtred in this rule level: medium
Near-miss passage: Sigma rule: Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for pers. Logsource: windows / process_creation. Rule: title: Uncommon Userinit Child Process id: 0a98a10c-685d-4ab0-bddc-b6bdd1d48458 related: - id: 21d856f9-9281-4ded-9377-51a1a6e2a432 type: similar status: test description: Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence. references: - https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html - https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-sconfig#powershell-is-the-default-shell-on-server-core author: Tom Ueltschi (@c_APT_ure), Tim Shelton date: 2019-01-12 modified: 2023-11-14 tags: - attack.privilege-escalation - attack.t1037.001 - attack.persistence logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \userinit.exe filter_main_explorer: Image|endswith: :\WINDOWS\explorer.exe filter_optional_logonscripts: CommandLine|contains: - netlogon.bat - UsrLogon.cmd filter_optional_windows_core: CommandLine: PowerShell.exe filter_optional_proquota: Image|endswith: - :\Windows\System32\proquota.exe - :\Windows\SysWOW64\proquota.exe filter_optional_citrix: Image|endswith: - :\Program Files (x86)\Citrix\HDX\bin\cmstart.exe - :\Program Files (x86)\Citrix\HDX\bin\icast.exe - :\Program Files (x86)\Citrix\System32\icast.exe - :\Program Files\Citrix\HDX\bin\cmstart.exe - :\Program Files\Citrix\HDX\bin\icast.exe - :\Program Files\Citrix\System32\icast.exe filter_optional_image_null: Image: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate logon scripts or custom shells may trigger false positives. Apply additional filters accordingly. level: high