Detection rules › Sigma

Potential Credential Dumping Attempt Using New NetworkProvider - REG

Severity
medium
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1003 OS Credential Dumping

Event coverage

ProviderEvent IDTitle
Sysmon13RegistryEvent (Value Set)

Stages and Predicates

Stage 1: selection

TargetObject|contains: '\NetworkProvider'
TargetObject|contains: '\System\CurrentControlSet\Services\'

Stage 2: not 1 of filter*

or:
Image: 'C:\Windows\System32\poqexec.exe'
TargetObject|contains: '\System\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider'
TargetObject|contains: '\System\CurrentControlSet\Services\RDPNP\NetworkProvider'
TargetObject|contains: '\System\CurrentControlSet\Services\WebClient\NetworkProvider'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imageeq
  • C:\Windows\System32\poqexec.exe corpus 7 (sigma 7)
TargetObjectmatch
  • \NetworkProvider
  • \System\CurrentControlSet\Services\
  • \System\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider
  • \System\CurrentControlSet\Services\RDPNP\NetworkProvider
  • \System\CurrentControlSet\Services\WebClient\NetworkProvider