Possible Impacket SecretDump Remote Activity

Title: Possible Impacket SecretDump Remote Activity
Status: test
Description:Detect AD credential dumping using impacket secretdump HKTL
References:
  -https://web.archive.org/web/20230329153811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html
Author: Samir Bousseaden, wagga
Date: 2019-04-03
modified:2022-08-11
Tags:

• -'attack.credential-access'
• -'attack.t1003.002'
• -'attack.t1003.004'
• -'attack.t1003.003'

Logsource:

• product: windows
• service: security
• definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure

Detection:
  selection:
    EventID: '5145'
    ShareName: '\\\\\*\\ADMIN$'
    RelativeTargetName|contains|all:
      -'SYSTEM32\'
      -'.tmp'

  condition:selection
Falsepositives:
  -Unknown
Level: high