Query: Sigma rule for Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file
Matching passage: Sigma rule: Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file. Logsource: windows / file_event. Rule: title: HackTool - NPPSpy Hacktool Usage id: cad1fe90-2406-44dc-bd03-59d0b58fe722 status: test description: Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md#atomic-test-2---credential-dumping-with-nppspy - https://twitter.com/0gtweet/status/1465282548494487554 author: Florian Roth (Nextron Systems) date: 2021-11-29 modified: 2024-06-27 tags: - attack.credential-access logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \NPPSpy.txt - \NPPSpy.dll condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious user agent strings used by malware in proxy logs. Logsource: proxy. Rule: title: Malware User Agent id: 5c84856b-55a5-45f1-826f-13f37250cf4e status: test description: Detects suspicious user agent strings used by malware in proxy logs references: - http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules - http://www.botopedia.org/search?searchword=scan&searchphrase=all - https://networkraptor.blogspot.com/2015/01/user-agent-strings.html - https://perishablepress.com/blacklist/ua-2013.txt - https://www.bluecoat.com/en-gb/security-blog/2015-05-05/know-your-agents - https://twitter.com/kladblokje_88/status/1614673320124743681?s=12&t=joEpeVa5d58aHYNGA_To7Q - https://pbs.twimg.com/media/FtYbfsDXoAQ1Y8M?format=jpg&name=large - https://twitter.com/crep1x/status/1635034100213112833 author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2017-07-08 modified: 2024-04-14 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent: - Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Chrome /53.0 - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1) - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0) - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322) - HttpBrowser/1.0 - '*<|>*' - nsis_inetc (mozilla) - Wget/1.9+cvs-stable (Red Hat modified) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322) - '*zeroup*' - Mozilla/5.0 (Windows NT 5.1 ; v.* - '* adlib/*' - '* tiny' - '* BGroom *' - '* changhuatong' - '* CholTBAgent' - Mozilla/5.0 WinInet - RookIE/1.0 - M - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0) - Mozilla/4.0 (compatible;MSIE 7.0;Windows NT 6.0) - backdoorbot - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) - Opera/8.81 (Windows NT 6.0; U; en) - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30729) - Opera - Mozilla/4.0 (compatible; MSIE 5.0; Windows 98) - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) - MSIE - '*(Charon; Inferno)' - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0) - Mozilla/4.0 (compatible; MSIE 6.1; Windows NT) - Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.1) - Mozilla/5.0 (Windows NT 10.0; Win64; x64) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64) - Mozilla/4.0