NPPSpy Hacktool File Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•30

Detects the use of the NPPSpy hacktool by monitoring for the creation of its characteristic output files, 'NPPSpy.txt' or 'NPPSpy.dll'. This tool is known to capture cleartext credentials from users logging into a local system.