PUA - NPS Tunneling Tool Execution

SigmaHQ Detections@sigmaHQ

•updated Nov 25, 2024•0•13

Detects the execution of 'npc.exe', the client component of NPS (a port forwarding and intranet penetration proxy server). Detection is based on the executable name, specific command-line arguments indicative of server connection and authentication, or known hashes of the 'npc.exe' client.