Possible Impacket SecretDump Remote Activity
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detect AD credential dumping using impacket secretdump HKTL
Severity
Trouble
Rule Requirement
Criteria
Action1:
actionname = "Network share object accessed" AND SHARENAME contains "ADMIN$" AND (RELATIVETARGETNAME contains "SYSTEM32" AND RELATIVETARGETNAME contains ".tmp")
select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.RELATIVETARGETNAME,Action1.SHARENAME,Action1.SHAREPATH,Action1.OBJECTNAME,Action1.OBJECTTYPE,Action1.REMOTEIP,Action1.REMOTEHOST,Action1.ACCESSLIST,Action1.ACCESSREASON,Action1.SECURITYID
Detection
Execution Mode
realtime
Log Sources
Active Directory
Author
Samir Bousseaden, wagga
