Query: detection rule: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the
Matching passage: Sigma rule: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the. Logsource: windows / registry_set. Rule: title: Potential Credential Dumping Attempt Using New NetworkProvider - REG id: 0442defa-b4a2-41c9-ae2c-ea7042fc4701 related: - id: baef1ec6-2ca9-47a3-97cc-4cf2bda10b77 type: similar status: test description: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it references: - https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade - https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-23 modified: 2023-08-17 tags: - attack.credential-access - attack.t1003 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \System\CurrentControlSet\Services\ - \NetworkProvider filter: TargetObject|contains: - \System\CurrentControlSet\Services\WebClient\NetworkProvider - \System\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider - \System\CurrentControlSet\Services\RDPNP\NetworkProvider filter_valid_procs: Image: C:\Windows\System32\poqexec.exe condition: selection and not 1 of filter* falsepositives: - Other legitimate network providers used and not filtred in this rule level: medium
Near-miss passage: Sigma rule: Detects potential calls to NtOpenProcess directly from NTDLL.. Logsource: windows / process_access. Rule: title: Potential Direct Syscall of NtOpenProcess id: 3f3f3506-1895-401b-9cc3-e86b16e630d0 status: test description: Detects potential calls to NtOpenProcess directly from NTDLL. references: - https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6 author: Christian Burkard (Nextron Systems), Tim Shelton (FP) date: 2021-07-28 modified: 2023-12-13 tags: - attack.execution - attack.t1106 logsource: category: process_access product: windows detection: selection: CallTrace|startswith: UNKNOWN filter_main_vcredist: TargetImage|endswith: vcredist_x64.exe SourceImage|endswith: vcredist_x64.exe filter_main_generic: SourceImage|contains: - :\Program Files (x86)\ - :\Program Files\ - :\Windows\System32\ - :\Windows\SysWOW64\ - :\Windows\WinSxS\ TargetImage|contains: - :\Program Files (x86)\ - :\Program Files\ - :\Windows\System32\ - :\Windows\SysWOW64\ - :\Windows\WinSxS\ filter_main_kerneltrace_edge: Provider_Name: Microsoft-Windows-Kernel-Audit-API-Calls filter_optional_vmware: TargetImage|endswith: :\Windows\system32\systeminfo.exe SourceImage|endswith: setup64.exe filter_optional_cylance: SourceImage|endswith: :\Windows\Explorer.EXE TargetImage|endswith: :\Program Files\Cylance\Desktop\CylanceUI.exe filter_optional_amazon: SourceImage|endswith: AmazonSSMAgentSetup.exe TargetImage|endswith: AmazonSSMAgentSetup.exe filter_optional_vscode: SourceImage|endswith: \AppData\Local\Programs\Microsoft VS Code\Code.exe TargetImage|endswith: \AppData\Local\Programs\Microsoft VS Code\Code.exe filter_optional_teams: TargetImage|endswith: \AppData\Local\Microsoft\Teams\current\Teams.exe SourceImage|endswith: \AppData\Local\Microsoft\Teams\current\Teams.exe filter_optional_discord: TargetImage|contains: \AppData\Local\Discord\ TargetImage|endswith: \Discord.exe filter_optional_yammer: SourceImage|contains: \AppData\Local\yammerdesktop\app- SourceImage|endswith: \Yammer.exe TargetImage|contains: \AppData\Local\yammerdesktop\app- TargetImage|endswith: \Yammer.exe GrantedAccess: '0x1000' filter_optional_evernote: TargetImage|endswith: \Evernote\Evernote.exe filter_optional_adobe_acrobat: SourceImage|contains: :\Program Files\Adobe\Acrobat DC\Acrobat\ SourceImage|endswith: \AcroCEF.exe TargetImage|contains: :\Program Files\Adobe\Acrobat DC\Acrobat\ TargetImage|endswith: \AcroCEF.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium