Potential Credential Dumping Attempt Using New NetworkProvider - CLI
Detects when a process attempts to add or modify a network provider by manipulating the Windows Registry, specifically targeting the 'NetworkProvider' key within 'System\CurrentControlSet\Services\'. This activity is indicative of potential credential dumping attempts, similar to techniques used by tools like NPPSpy, which can register a malicious network provider DLL to capture cleartext credentials during the authentication process.
Sigma
