Potential Credential Dumping Attempt Using New NetworkProvider - Registry

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•30

Detects when an attacker attempts to add a new network provider by modifying the registry, which can be used to dump clear text credentials. This technique is similar to how tools like NPPSpy operate by registering a malicious network provider DLL to intercept credentials during the authentication process.