Windows File Writes from NPPSpy Hacktool: NPPSpy.txt and NPPSpy.dll
Alerts on Windows file events writing NPPSpy.txt or NPPSpy.dll, consistent with credential dumping by the NPPSpy hacktool.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- file_event
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-11-29
- Updated
- 2026-07-31
What it detects
This rule flags file creation or modification events where the target filename ends with NPPSpy.txt or NPPSpy.dll. NPPSpy is a credential-dumping hacktool that can write captured cleartext credentials to a local file, so file artifacts like these are strong indicators of unauthorized access attempts. It relies on Windows file event telemetry that includes the target filename for the write operation.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md#atomic-test-2---credential-dumping-with-nppspy
- twitter.comhttps://twitter.com/0gtweet/status/1465282548494487554
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_nppspy.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-file-writes-to-nppspy-txt-or-nppspy-dll-indicates-hacktool-credential-du-cad1fe90
title: "Windows File Writes from NPPSpy Hacktool: NPPSpy.txt and NPPSpy.dll"
id: 266a4893-f7ed-4d0a-a747-51734c2b3275
status: test
description: This rule flags file creation or modification events where the target filename ends with NPPSpy.txt or NPPSpy.dll. NPPSpy is a credential-dumping hacktool that can write captured cleartext credentials to a local file, so file artifacts like these are strong indicators of unauthorized access attempts. It relies on Windows file event telemetry that includes the target filename for the write operation.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md#atomic-test-2---credential-dumping-with-nppspy
- https://twitter.com/0gtweet/status/1465282548494487554
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_nppspy.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-11-29
modified: 2024-06-27
tags:
- attack.credential-access
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|endswith:
- \NPPSpy.txt
- \NPPSpy.dll
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: cad1fe90-2406-44dc-bd03-59d0b58fe722
type: derived