Detect Suspicious ncrypt.dll usage by CLI tool or unknown process

Author: Robbe Van den Daele
Source: github.com/HybridBrothers/Hunting-Queries-Detection-Rules

This detection rule uses a WDAC audit policy to ingest missing DeviceImageLoad events in MDE, and check for suspicious processes using the ncrypt.dll. More information on the attack scenario this is detection is applicable for can be found in the references.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1555.004` Credentials from Password Stores: Windows Credential Manager `T1606` Forge Web Credentials

References

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceEvents` action `any`: Defender event

Rule body

let cli_tools = dynamic(["powershell", "python"]);
// Get suspicious ncrypt.dll usage via WDAC audit policy
DeviceEvents
| where ActionType startswith "AppControl" and FileName =~ "ncrypt.dll"
| invoke FileProfile(InitiatingProcessSHA1, 1000)
| where (
    // Flag CLI tools
    InitiatingProcessFileName has_any (cli_tools) or 
    // Flag unknown processes
    GlobalPrevalence < 250
)
| sort by TimeGenerated desc

Stages and Predicates

Parameters

let cli_tools = dynamic(["powershell", "python"]);

Stage 1: `source`

DeviceEvents

Stage 2: `where`

| where ActionType startswith "AppControl" and FileName =~ "ncrypt.dll"

Stage 3: `invoke`

| invoke FileProfile(InitiatingProcessSHA1, 1000)

Stage 4: `where`

| where (
    InitiatingProcessFileName has_any (cli_tools) or 
    GlobalPrevalence < 250
)

Stage 5: `sort`

| sort by TimeGenerated desc

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActionType`	starts_with	`AppControl`	`field:"ActionType" kind:starts_with value:"AppControl"`
`FileName`	eq	`ncrypt.dll`	`field:"file_name" kind:eq value:"ncrypt.dll"`
`GlobalPrevalence`	lt	`250`	`field:"GlobalPrevalence" kind:lt value:"250"`
`InitiatingProcessFileName`	match	`powershell` transforms: `term` `python` transforms: `term`	`field:"parent_process_name" kind:match`