The netpass variant detection rule identifies potential credential theft or lateral movement by monitoring unusual network connection patterns that may indicate unauthorized access or data exfiltration. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect early-stage adversaries leveraging compromised credentials to move laterally within the network.
rule NetPass : Variant {
meta:
description = "netpass variant"
author = "Katie Kleemola"
last_updated = "2014-07-08"
condition:
NetpassStrings
}
This YARA rule can be deployed in the following contexts:
Scenario: Scheduled System Maintenance Job
Description: A legitimate scheduled task runs a script that uses netpass to update credentials for a service account.
Filter/Exclusion: process.parent_process_name == "schtasks.exe" or process.command_line_contains("schtasks")
Scenario: Active Directory Replication
Description: netpass is used during Active Directory replication to synchronize credentials between domain controllers.
Filter/Exclusion: process.parent_process_name == "ntdsutil.exe" or process.command_line_contains("repadmin")
Scenario: Admin Task to Reset User Passwords
Description: An administrator uses a script or tool like PowerShell or netdom to reset user passwords, which may invoke netpass.
Filter/Exclusion: process.parent_process_name == "powershell.exe" and process.command_line_contains("Reset-LocalUser")
Scenario: Credential Synchronization Tool
Description: A third-party credential synchronization tool (e.g., Microsoft Azure AD Connect) uses netpass during synchronization.
Filter/Exclusion: process.parent_process_name == "AzureADConnect.exe" or process.command_line_contains("AzureADConnect")
Scenario: Network Discovery or Inventory Tool
Description: A network discovery tool (e.g., Nmap, SolarWinds, or Microsoft Baseline Security Analyzer) may use netpass during system inventory.
Filter/Exclusion: process.parent_process_name == "nmap.exe" or process.command_line_contains("nmap")