Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
3
Categories
2
1
1
1
Platforms
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects when a process attempts to add or modify a network provider by manipulating the Windows Registry, specifically targeting the 'NetworkProvider' key within 'System\CurrentControlSet\Services\'. This activity is indicative of potential credential dumping attempts, similar to techniques used by tools like NPPSpy, which can register a malicious network provider DLL to capture cleartext credentials during the authentication process.
Detects the use of the NPPSpy hacktool by monitoring for the creation of its characteristic output files, 'NPPSpy.txt' or 'NPPSpy.dll'. This tool is known to capture cleartext credentials from users logging into a local system.
Detects when an attacker attempts to add a new network provider by modifying the registry, which can be used to dump clear text credentials. This technique is similar to how tools like NPPSpy operate by registering a malicious network provider DLL to intercept credentials during the authentication process.