Anvilogic high experimental other

Possible Credential Dumping via Windows Network Providers [snowflake-crowdstrikefdr_process]

A Network Provider is a Windows component that facilitates the connection, communication, and resource sharing between a system and a network. Threat actors can create a rogue Network Provider to capture or "dump" credentials by intercepting and logging network authentication requests, such as NPPSpy. This use case detects modifications to registry values for Network Providers. Atomics T1003 Test #2

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform ilike '%Win%' and (process_path ilike '%reg.exe' or process_path ilike '%pwsh.exe' or process_path ilike '%powershell.exe' or process_path ilike '%powershell_ise.exe' or process_path ilike '%cmd.exe') and (regexp_like(process, '.*\\\x5cSYSTEM\\\x5cCurrentControlSet\\\x5cServices\\\S+\\\x5cNetworkProviders.*', 'i') or regexp_like(process, '.*\\\x5cSYSTEM\\\x5cCurrentControlSet\\\x5cControl\\\S+\\\x5cNetworkProvider\\\x5cOrder.*', 'i'))

Field Validations

Loading…

Comments (0)

Loading comments...