HackTool - Impacket File Indicators

Title: HackTool - Impacket File Indicators
Status: experimental
Description:Detects file creation events with filename patterns used by Impacket.
References:
  -https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/
  -https://github.com/fortra/impacket
Author: The DFIR Report, IrishDeath
Date: 2025-05-19
modified:None
Tags:

• -'attack.credential-access'
• -'attack.t1003.001'

Logsource:

• product: windows
• category: file_event

Detection:
  selection_names_re:
    TargetFilename|re: '\\sessionresume_[a-zA-Z]{8}$'
  condition:selection_names_re
Falsepositives:
  -Unknown
Level: high