{"id":"baef1ec6-2ca9-47a3-97cc-4cf2bda10b77","title":"Potential Credential Dumping Attempt Using New NetworkProvider - CLI","description":"Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-23","modified":"2023-02-02","tags":["attack.credential-access","attack.t1003"],"technique_ids":["T1003"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Other legitimate network providers used and not filtred in this rule"],"references":["https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade","https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy"],"source_path":"rules/windows/process_creation/proc_creation_win_registry_new_network_provider.yml","source_sha256":"082ea1a46b55940f5411977dbba50a944befd7b81ddaad886cdf77d1fcf2f2b1","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_registry_new_network_provider.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Credential Dumping Attempt Using New NetworkProvider - CLI\nid: baef1ec6-2ca9-47a3-97cc-4cf2bda10b77\nrelated:\n    - id: 0442defa-b4a2-41c9-ae2c-ea7042fc4701\n      type: similar\nstatus: test\ndescription: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it\nreferences:\n    - https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade\n    - https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-08-23\nmodified: 2023-02-02\ntags:\n    - attack.credential-access\n    - attack.t1003\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains|all:\n            - '\\System\\CurrentControlSet\\Services\\'\n            - '\\NetworkProvider'\n    # filter:\n    #     CommandLine|contains:\n    #         - '\\System\\CurrentControlSet\\Services\\WebClient\\NetworkProvider'\n    #         - '\\System\\CurrentControlSet\\Services\\LanmanWorkstation\\NetworkProvider'\n    #         - '\\System\\CurrentControlSet\\Services\\RDPNP\\NetworkProvider'\n    #         - '\\System\\CurrentControlSet\\Services\\P9NP\\NetworkProvider' # Related to WSL remove the comment if you use WSL in your ENV\n    condition: selection\nfalsepositives:\n    - Other legitimate network providers used and not filtred in this rule\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003","id":"T1003","name":"OS Credential Dumping","page":"techniques/enterprise/T1003/"}],"data_path":"data/detection-rules/baef1ec6-2ca9-47a3-97cc-4cf2bda10b77.json","kind":"sigma"}