Windows File Writes to NPPSpy.txt or NPPSpy.dll Indicates HackTool Credential Dumping

title: Windows File Writes to NPPSpy.txt or NPPSpy.dll Indicates HackTool Credential Dumping
id: 266a4893-f7ed-4d0a-a747-51734c2b3275
status: test
description: This rule flags Windows file creation or modification events where the target filename ends with NPPSpy.txt or NPPSpy.dll. NPPSpy is a hacktool that can capture and store cleartext passwords for users that have logged in, so writing these artifacts is a strong indicator of credential-access activity. The detection relies on file event telemetry that includes the target filename and supports suffix matching on the path.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md#atomic-test-2---credential-dumping-with-nppspy
  - https://twitter.com/0gtweet/status/1465282548494487554
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_nppspy.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-11-29
modified: 2024-06-27
tags:
  - attack.credential-access
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - \NPPSpy.txt
      - \NPPSpy.dll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: cad1fe90-2406-44dc-bd03-59d0b58fe722
    type: derived