Possible Impacket SecretDump Remote Activity - Zeek

Title: Possible Impacket SecretDump Remote Activity - Zeek
Status: test
Description:Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml
References:
  -https://web.archive.org/web/20230329153811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html
Author: Samir Bousseaden, @neu5ron
Date: 2020-03-19
modified:2021-11-27
Tags:

• -'attack.credential-access'
• -'attack.t1003.002'
• -'attack.t1003.004'
• -'attack.t1003.003'

Logsource:

• product: zeek
• service: smb_files

Detection:
  selection:
    path|contains|all:
      -'\'
      -'ADMIN$'

    name|contains: 'SYSTEM32\'
    name|endswith: '.tmp'
  condition:selection
Falsepositives:
  -Unknown
Level: high