1type: trigger
2name: sigmahq/proc_creation_win_pua_nps
3description: |
4  Detects the use of NPS, a port forwarding and intranet penetration proxy server
5filter: |
6  (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.Image endsWith '\\npc.exe' || evt.Parsed.CommandLine contains ' -server=' && evt.Parsed.CommandLine contains ' -vkey=' && evt.Parsed.CommandLine contains ' -password=' || evt.Parsed.CommandLine contains ' -config=npc' || evt.Parsed.Hashes contains 'MD5=AE8ACF66BFE3A44148964048B826D005' || evt.Parsed.Hashes contains 'SHA1=CEA49E9B9B67F3A13AD0BE1C2655293EA3C18181' || evt.Parsed.Hashes contains 'SHA256=5A456283392FFCEEEACA3D3426C306EB470304637520D72FED1CC1FEBBBD6856' || evt.Parsed.md5 == 'ae8acf66bfe3a44148964048b826d005' || evt.Parsed.sha1 == 'cea49e9b9b67f3a13ad0be1c2655293ea3c18181' || evt.Parsed.sha256 == '5a456283392ffceeeaca3d3426c306eb470304637520d72fed1cc1febbbd6856')
7blackhole: 2m
8#status: test
9labels:
10  service: windows
11  confidence: 1
12  spoofable: 0
13  classification:
14   - attack.t1090
15
16  label: "PUA - NPS Tunneling Tool Execution"
17  behavior : "windows:audit"
18  remediation: false
19
20scope:
21  type: ParentProcessId
22  expression: evt.Parsed.ParentProcessId
23
24