Detection rules › Kusto
Detect Suspicious ncrypt.dll usage by CLI tool or unknown process
This detection rule uses a WDAC audit policy to ingest missing DeviceImageLoad events in MDE, and check for suspicious processes using the ncrypt.dll. More information on the attack scenario this is detection is applicable for can be found in the references.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1555.004 Credentials from Password Stores: Windows Credential Manager, T1606 Forge Web Credentials |
References
Event coverage
| Provider | ActionType | Title |
|---|---|---|
| Defender-DeviceEvents | any | Defender event (any) |
Rule body yaml
let cli_tools = dynamic(["powershell", "python"]);
// Get suspicious ncrypt.dll usage via WDAC audit policy
DeviceEvents
| where ActionType startswith "AppControl" and FileName =~ "ncrypt.dll"
| invoke FileProfile(InitiatingProcessSHA1, 1000)
| where (
// Flag CLI tools
InitiatingProcessFileName has_any (cli_tools) or
// Flag unknown processes
GlobalPrevalence < 250
)
| sort by TimeGenerated desc
Stages and Predicates
Parameters
let cli_tools = dynamic(["powershell", "python"]);
Stage 1: source
DeviceEvents
Stage 2: where
| where ActionType startswith "AppControl" and FileName =~ "ncrypt.dll"
Stage 3: invoke
| invoke FileProfile(InitiatingProcessSHA1, 1000)
Stage 4: where
| where (
InitiatingProcessFileName has_any (cli_tools) or
GlobalPrevalence < 250
)
Stage 5: sort
| sort by TimeGenerated desc
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
ActionType | starts_with |
|
FileName | eq |
|
GlobalPrevalence | lt |
|
InitiatingProcessFileName | match |
|