Detection rules › Kusto

Detect Suspicious ncrypt.dll usage by CLI tool or unknown process

Author
Robbe Van den Daele
Source
github.com/HybridBrothers/Hunting-Queries-Detection-Rules

This detection rule uses a WDAC audit policy to ingest missing DeviceImageLoad events in MDE, and check for suspicious processes using the ncrypt.dll. More information on the attack scenario this is detection is applicable for can be found in the references.

MITRE ATT&CK coverage

References

Event coverage

Rule body yaml

let cli_tools = dynamic(["powershell", "python"]);
// Get suspicious ncrypt.dll usage via WDAC audit policy
DeviceEvents
| where ActionType startswith "AppControl" and FileName =~ "ncrypt.dll"
| invoke FileProfile(InitiatingProcessSHA1, 1000)
| where (
    // Flag CLI tools
    InitiatingProcessFileName has_any (cli_tools) or 
    // Flag unknown processes
    GlobalPrevalence < 250
)
| sort by TimeGenerated desc

Stages and Predicates

Parameters

let cli_tools = dynamic(["powershell", "python"]);

Stage 1: source

DeviceEvents

Stage 2: where

| where ActionType startswith "AppControl" and FileName =~ "ncrypt.dll"

Stage 3: invoke

| invoke FileProfile(InitiatingProcessSHA1, 1000)

Stage 4: where

| where (
    InitiatingProcessFileName has_any (cli_tools) or 
    GlobalPrevalence < 250
)

Stage 5: sort

| sort by TimeGenerated desc

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ActionTypestarts_with
  • AppControl corpus 5 (kusto 5)
FileNameeq
  • ncrypt.dll corpus 4 (kusto 4)
GlobalPrevalencelt
  • 250 transforms: cased corpus 4 (kusto 4)
InitiatingProcessFileNamematch
  • powershell corpus 2 (kusto 2)
  • python corpus 2 (kusto 2)