Sigma rule: Transferring Files with Credential Data via Network Shares - Zeek

Rule

Title

Transferring Files with Credential Data via Network Shares - Zeek

Status

test

Level

medium

Author

@neu5ron, Teymur Kheirkhabarov, oscd.community

Date

2020-04-02

Modified

2021-11-27

File

rules/network/zeek/zeek_smb_converted_win_transferring_files_with_credential_data.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Transferring files with well-known filenames (sensitive files with credential data) using network shares

Log source

product

zeek

service

smb_files

Detection

selection:
    name:
        - '\mimidrv'
        - '\lsass'
        - '\windows\minidump\'
        - '\hiberfil'
        - '\sqldmpr'
        - '\sam'
        - '\ntds.dit'
        - '\security'
condition: selection

False positives (as the rule lists them)

• Transferring sensitive files for legitimate administration work by legitimate administrator

Tags

• attack.credential-access
• attack.t1003.002
• attack.t1003.001
• attack.t1003.003

MITRE ATT&CK ids this rule names

• T1003.001
• T1003.002
• T1003.003

Related rules

• 910ab938-668b-401b-b08c-b596e80fdca5 (similar)

References

• https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/network/zeek/zeek_smb_converted_win_transferring_files_with_credential_data.yml