In a recent intrusion, we identified a threat actor had compromised the Windows login process, and siphoned cleartext credentials - using a technique known as NPPSPY
@0gtweet’s NPPSPY was fascinating to dissect and remediate.
Huge thanks to @keydet89 for guidance and wisdom
@0gtweet’s NPPSPY was fascinating to dissect and remediate.
Huge thanks to @keydet89 for guidance and wisdom
https://twitter.com/huntresslabs/status/1559779051480530944
Our article couldn’t show what this cleartext credential gathering looked like on the compromised machine, but we recreated the electrifying end product
IOCs and Behavior
- T1003
- Values under HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
◦For our case: logincontroll
- Unexplained entries in HKLM\SYSTEM\CurrentControlSet\Services\<here>\NetworkProvider
◦For our case: logincontroll
- T1003
- Values under HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
◦For our case: logincontroll
- Unexplained entries in HKLM\SYSTEM\CurrentControlSet\Services\<here>\NetworkProvider
◦For our case: logincontroll
- Unexplained DLLS in folders (very difficult to detect)
◦For our case: C:\windows\system32\lsass.dll
- Files being continually written too (essentially impossible to detect this IMO)
◦For our case: C:\Windows\Temp\tmpCQOF.tmp
◦For our case: C:\windows\system32\lsass.dll
- Files being continually written too (essentially impossible to detect this IMO)
◦For our case: C:\Windows\Temp\tmpCQOF.tmp
If you’re interested in more details, have a lil read of this huntress.com/blog/cleartext…
As always, thank you to our content team, @rachelbishop723 and Lily Teplow
As always, thank you to our content team, @rachelbishop723 and Lily Teplow
• • •
Missing some Tweet in this thread? You can try to
force a refresh
