Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
3
2
1
Contributors
3
2
1
Categories
4
2
1
1
1
Platforms
5
1
Products / Services
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects registration of malicious network provider DLLs to capture credentials
This rule detects network traffic on port 445 (SMB) containing the strings "Network Providers" and "ProviderPath" (case-insensitive). This pattern is indicative of an attempt to register a malicious Network Provider DLL for credential capture, a technique used by adversaries to persist and steal credentials.
This query was originally published in the threat analytics report, Ransomware continues to hit healthcare, critical services. There is also a related blog.
Robbinhood is ransomware that has been involved in several high-profile incidents, including a 2019 attack on the city of Baltimore, Maryland. Robbinhood operators often employ a distinctive defense evasion technique, where they load a vulnerable driver on to a target and exploit it, in order to turn off security software -- essentially using the driver as malware.
The following query detects a late stage of this technique, when the operator is issuing commands to turn off the driver.
For a query that detects an earlier stage of this technique, see Detect loading of vulnerable drivers by Robbinhood ransomware campaign.
References:
https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Robinhood.A&ThreatID=2147735370
https://www.nytimes.com/2019/05/22/us/baltimore-ransomware.html
Robbinhood is ransomware that has been involved in several high-profile incidents, including a 2019 attack on the city of Baltimore, Maryland. Robbinhood operators often employ a distinctive defense evasion technique, where they load a vulnerable driver on to a target and exploit it, in order to turn off security software -- essentially using the driver as malware.
The following query detects a late stage of this technique, when the operator is issuing commands to turn off the driver.
For a query that detects an earlier stage of this technique, see Detect loading of vulnerable drivers by Robbinhood ransomware campaign.
References:
https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Robinhood.A&ThreatID=2147735370
https://www.nytimes.com/2019/05/22/us/baltimore-ransomware.html
Detects when a process attempts to add or modify a network provider by manipulating the Windows Registry, specifically targeting the 'NetworkProvider' key within 'System\CurrentControlSet\Services\'. This activity is indicative of potential credential dumping attempts, similar to techniques used by tools like NPPSpy, which can register a malicious network provider DLL to capture cleartext credentials during the authentication process.
Detects the use of the NPPSpy hacktool by monitoring for the creation of its characteristic output files, 'NPPSpy.txt' or 'NPPSpy.dll'. This tool is known to capture cleartext credentials from users logging into a local system.
Detects when an attacker attempts to add a new network provider by modifying the registry, which can be used to dump clear text credentials. This technique is similar to how tools like NPPSpy operate by registering a malicious network provider DLL to intercept credentials during the authentication process.