Possible Impacket SecretDump Remote Activity
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detect AD credential dumping using impacket secretdump HKTL
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Network share object accessed" AND SHARENAME contains "ADMIN$" AND (RELATIVETARGETNAME contains "SYSTEM32" AND RELATIVETARGETNAME contains ".tmp") select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.RELATIVETARGETNAME,Action1.SHARENAME,Action1.SHAREPATH,Action1.OBJECTNAME,Action1.OBJECTTYPE,Action1.REMOTEIP,Action1.REMOTEHOST,Action1.ACCESSLIST,Action1.ACCESSREASON
Detection
Execution Mode
realtime
Log Sources
Active Directory
Author
Samir Bousseaden, wagga
