DumpGuard NTLM challenge detected

Author: Robbe Van den Daele
Source: github.com/HybridBrothers/Hunting-Queries-Detection-Rules

With the DumpGuard tool, attackers are able to dump credetials via Remote Credential Guard on devices that have Credential Guard enabled. The creator of the DumpGuard tool purposely used a hard-coded NTLMv1 challenge into the tool, for easy detection. > [!WARNING] > Since the detection relies on a static IOC that can easily be changed in the source code, this detection has a low confidence score since it can be easily bypassed. However, if the detection hits it is almost 100% certain the alert will be TP. > Also take into account that the NetworkSignatureInspected ActionType in MDE is sampled, which means not very event will be logged.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.004` OS Credential Dumping: LSA Secrets

References

https://specterops.io/blog/2025/10/23/catching-credential-guard-off-guard/

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceNetworkEvents` action `NetworkSignatureInspected`: Network signature inspected

Rule body

DeviceNetworkEvents
// Get NTLM Challenges
| where ActionType == "NetworkSignatureInspected"
| where tostring(todynamic(AdditionalFields).SignatureName) =~ "NTLM-Challenge"
// Extract the NTLM Sample Packet
| extend SamplePacketContent = extract('\\["(.+)"\\]', 1, tostring(todynamic(AdditionalFields).SamplePacketContent))
// Remove % values, since the '1122334455667788' is easy to find without conversions
| extend NewSamplePacketContent = strcat_array(split(SamplePacketContent, "%"), "")
| where NewSamplePacketContent contains "1122334455667788"

Stages and Predicates

Stage 1: `source`

DeviceNetworkEvents

Stage 2: `where`

| where ActionType == "NetworkSignatureInspected"

Stage 3: `where`

| where tostring(todynamic(AdditionalFields).SignatureName) =~ "NTLM-Challenge"

Stage 4: `extend`

| extend SamplePacketContent = extract('\\["(.+)"\\]', 1, tostring(todynamic(AdditionalFields).SamplePacketContent))

Stage 5: `extend`

| extend NewSamplePacketContent = strcat_array(split(SamplePacketContent, "%"), "")

Stage 6: `where`

| where NewSamplePacketContent contains "1122334455667788"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActionType`	eq	`NetworkSignatureInspected`	`field:"ActionType" kind:eq value:"NetworkSignatureInspected"`
`NewSamplePacketContent`	contains	`1122334455667788`	`field:"NewSamplePacketContent" kind:contains value:"1122334455667788"`
`SignatureName`	eq	`NTLM-Challenge` transforms: `tostring`	`field:"SignatureName" kind:eq value:"NTLM-Challenge"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`SamplePacketContent`	`extend`
`NewSamplePacketContent`	`extend`