cscli scenarios install sigmahq/proc_creation_win_pua_nps1type: trigger2name: sigmahq/proc_creation_win_pua_nps3description: |4 Detects the use of NPS, a port forwarding and intranet penetration proxy server5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.Image endsWith '\\npc.exe' || evt.Parsed.CommandLine contains ' -server=' && evt.Parsed.CommandLine contains ' -vkey=' && evt.Parsed.CommandLine contains ' -password=' || evt.Parsed.CommandLine contains ' -config=npc' || evt.Parsed.Hashes contains 'MD5=AE8ACF66BFE3A44148964048B826D005' || evt.Parsed.Hashes contains 'SHA1=CEA49E9B9B67F3A13AD0BE1C2655293EA3C18181' || evt.Parsed.Hashes contains 'SHA256=5A456283392FFCEEEACA3D3426C306EB470304637520D72FED1CC1FEBBBD6856' || evt.Parsed.md5 == 'ae8acf66bfe3a44148964048b826d005' || evt.Parsed.sha1 == 'cea49e9b9b67f3a13ad0be1c2655293ea3c18181' || evt.Parsed.sha256 == '5a456283392ffceeeaca3d3426c306eb470304637520d72fed1cc1febbbd6856')7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t10901516 label: "PUA - NPS Tunneling Tool Execution"17 behavior : "windows:audit"18 remediation: false1920scope:21 type: ParentProcessId22 expression: evt.Parsed.ParentProcessId2324