Potential Credential Dumping Attempt Using New NetworkProvider - REG

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•1

Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it