Windows: NPS (npc.exe) Port Forwarding Proxy Execution via Command-Line Parameters

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1090Proxy
Exfiltration
Impact

What it detects

This rule identifies execution of the NPS tunneling/port-forwarding tool by matching process creations where the image ends with npc.exe and the command line includes NPS-specific server and credential options. It also flags instances using an NPS configuration parameter (" -config=npc"). Such behavior matters because NPS can enable intranet penetration and covert traffic forwarding, and the detection relies on Windows process creation telemetry including image name, full command line, and (optionally) known hashes.

Reporting behind it

Related detections9 linkedT1090 — drag to rearrange

Suspicious Flax Typhoon System Utility Masquerade Outside System32 via Renamed VPN Client (via process_creation)

Possible Credential Stuffing Blocked by Conditional Access in Microsoft 365

Possible ReverseSocks5 Tunneling Tool Execution on Linux (via process_creation)

Malicious GhostSocks Loader Execution with johnpidar Argument via process_creation

Malicious Chisel Reverse SOCKS Proxy Execution (via process_creation)

Malicious QEMU Covert Network Tunnel via User-Mode netdev Socket (via process_creation)

Malicious Tunneling Tool Execution on Linux Host (via process_creation)

Suspicious Chisel Reverse Tunnel Execution by UAT-9686

Suspicious macOS Trojan-Proxy LaunchAgent GoogleHelperUpdater Persistence (via file_event)

Windows: NPS (npc.exe) Port Forwarding Proxy Execution via Command-Line Parameters

Pivot detection · T1090 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-nps-npc-exe-port-forwarding-proxy-execution-via-command-line-parameters-68d37776

title: "Windows: NPS (npc.exe) Port Forwarding Proxy Execution via Command-Line Parameters"
id: 5e12dcb4-c407-463e-8723-605f9d7bff93
status: test
description: This rule identifies execution of the NPS tunneling/port-forwarding tool by matching process creations where the image ends with npc.exe and the command line includes NPS-specific server and credential options. It also flags instances using an NPS configuration parameter (" -config=npc"). Such behavior matters because NPS can enable intranet penetration and covert traffic forwarding, and the detection relies on Windows process creation telemetry including image name, full command line, and (optionally) known hashes.
references:
  - https://github.com/ehang-io/nps
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_nps.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-10-08
modified: 2024-11-23
tags:
  - attack.command-and-control
  - attack.t1090
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \npc.exe
  selection_cli_1:
    CommandLine|contains|all:
      - " -server="
      - " -vkey="
      - " -password="
  selection_cli_2:
    CommandLine|contains: " -config=npc"
  selection_hashes:
    Hashes|contains:
      - MD5=AE8ACF66BFE3A44148964048B826D005
      - SHA1=CEA49E9B9B67F3A13AD0BE1C2655293EA3C18181
      - SHA256=5A456283392FFCEEEACA3D3426C306EB470304637520D72FED1CC1FEBBBD6856
  condition: 1 of selection_*
falsepositives:
  - Legitimate use
level: high
license: DRL-1.1
related:
  - id: 68d37776-61db-42f5-bf54-27e87072d17e
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL