Detection rules › Kusto
Detect Suspicious ncrypt.dll usage by process requesting Entra ID Nonce
This detection rule uses a WDAC audit policy to ingest missing DeviceImageLoad events in MDE, and check for suspicious processes using the ncrypt.dll and requesting an Entra ID Nonce. More information on the attack scenario this is detection is applicable for can be found in the references.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
References
Telemetry coverage
Rule body
let cli_tools = dynamic(["powershell", "python"]);
// Get all possible nonce requests
let nonce_requests = (
DeviceNetworkEvents
| where Timestamp > ago(1h)
| where ActionType startswith "ConnectionSuccess"
| where RemoteUrl =~ "login.microsoftonline.com"
| project-rename NonceTimestamp = Timestamp
);
// Get suspicious ncrypt.dll usage via WDAC audit policy
DeviceEvents
| where Timestamp > ago(1h)
| where ActionType startswith "AppControl" and FileName =~ "ncrypt.dll"
// Check if the same initiating process is doing a nonce request
| join kind=inner nonce_requests on InitiatingProcessId, DeviceId
// Only flag when nonce was request 10min before of after ncrypt usage
| where Timestamp between (todatetime(NonceTimestamp - 10m) .. todatetime(NonceTimestamp + 10m))
| invoke FileProfile(InitiatingProcessSHA1, 1000)
| where (
// Flag CLI tools
InitiatingProcessFileName has_any (cli_tools) or
// Flag unknown processes
GlobalPrevalence < 250
)
let cli_tools = dynamic(["powershell", "python"]);
// Get all possible nonce requests
let nonce_requests = (
DeviceNetworkEvents
| where TimeGenerated > ago(1h)
| where ActionType startswith "ConnectionSuccess"
| where RemoteUrl =~ "login.microsoftonline.com"
| project-rename NonceTimestamp = TimeGenerated
);
// Get suspicious ncrypt.dll usage via WDAC audit policy
DeviceEvents
| where TimeGenerated > ago(1h)
| where ActionType startswith "AppControl" and FileName =~ "ncrypt.dll"
// Check if the same initiating process is doing a nonce request
| join kind=inner nonce_requests on InitiatingProcessId, DeviceId
// Only flag when nonce was request 10min before of after ncrypt usage
| where TimeGenerated between (todatetime(NonceTimestamp - 10m) .. todatetime(NonceTimestamp + 10m))
| invoke FileProfile(InitiatingProcessSHA1, 1000)
| where (
// Flag CLI tools
InitiatingProcessFileName has_any (cli_tools) or
// Flag unknown processes
GlobalPrevalence < 250
)
Stages and Predicates
Parameters
let cli_tools = dynamic(["powershell", "python"]);
Let binding: nonce_requests
let nonce_requests = (
DeviceNetworkEvents
| where Timestamp > ago(1h)
| where ActionType startswith "ConnectionSuccess"
| where RemoteUrl =~ "login.microsoftonline.com"
| project-rename NonceTimestamp = Timestamp
);
Stage 1: source
let nonce_requests
Stage 2: source
DeviceEvents
Stage 3: where
where Timestamp > ago(3600s)
Stage 4: where
where ActionType startswith "AppControl" and FileName =~ "ncrypt.dll"
Stage 5: join
join kind=inner (nonce_requests) on InitiatingProcessId, DeviceId
Stage 6: where
where /* macro: (Timestamp between (todatetime((NonceTimestamp - 10m)) .. todatetime((NonceTimestamp + 10m)))) */
Stage 7: invoke
invoke
Stage 8: where
where (GlobalPrevalence < 250 or (InitiatingProcessFileName contains "powershell" or InitiatingProcessFileName contains "python"))
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ActionType | starts_with |
| field:"ActionType" kind:starts_with |
FileName | eq |
| field:"file_name" kind:eq value:"ncrypt.dll" |
GlobalPrevalence | lt |
| field:"GlobalPrevalence" kind:lt value:"250" |
InitiatingProcessFileName | match |
| field:"parent_process_name" kind:match |
RemoteUrl | eq |
| field:"DestinationHostname" kind:eq value:"login.microsoftonline.com" |