Potential Credential Dumping Attempt Using New NetworkProvider - REG

Status: test
Severity: medium
Log source: category registry_set, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

Known false positives

Other legitimate network providers used and not filtred in this rule

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003` OS Credential Dumping

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Potential Credential Dumping Attempt Using New NetworkProvider - REG
id: 0442defa-b4a2-41c9-ae2c-ea7042fc4701
related:
    - id: baef1ec6-2ca9-47a3-97cc-4cf2bda10b77
      type: similar
status: test
description: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it
references:
    - https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade
    - https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-23
modified: 2023-08-17
tags:
    - attack.credential-access
    - attack.t1003
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains|all:
            - '\System\CurrentControlSet\Services\'
            - '\NetworkProvider'
    filter:
        TargetObject|contains:
            - '\System\CurrentControlSet\Services\WebClient\NetworkProvider'
            - '\System\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider'
            - '\System\CurrentControlSet\Services\RDPNP\NetworkProvider'
            # - '\System\CurrentControlSet\Services\P9NP\NetworkProvider' # Related to WSL remove the comment if you use WSL in your ENV
    filter_valid_procs:
        Image: C:\Windows\System32\poqexec.exe
    condition: selection and not 1 of filter*
falsepositives:
    - Other legitimate network providers used and not filtred in this rule
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter*

Stage 1: `selection`

selection:
    TargetObject|contains|all:
        - '\System\CurrentControlSet\Services\'
        - '\NetworkProvider'

Stage 2: `not filter*`

filter:
    TargetObject|contains:
        - '\System\CurrentControlSet\Services\WebClient\NetworkProvider'
        - '\System\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider'
        - '\System\CurrentControlSet\Services\RDPNP\NetworkProvider'
filter_valid_procs:
    Image: C:\Windows\System32\poqexec.exe

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	eq	`C:\Windows\System32\poqexec.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\System32\poqexec.exe"`
`TargetObject`	match	`\System\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider`	`excludes:TargetObject` `field:"TargetObject" value:"\System\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider"`
`TargetObject`	match	`\System\CurrentControlSet\Services\RDPNP\NetworkProvider`	`excludes:TargetObject` `field:"TargetObject" value:"\System\CurrentControlSet\Services\RDPNP\NetworkProvider"`
`TargetObject`	match	`\System\CurrentControlSet\Services\WebClient\NetworkProvider`	`excludes:TargetObject` `field:"TargetObject" value:"\System\CurrentControlSet\Services\WebClient\NetworkProvider"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetObject`	match	`\NetworkProvider` `\System\CurrentControlSet\Services\`	`field:"TargetObject" kind:match`