Sigma rule: Copying Sensitive Files with Credential Data

Rule

Title

Copying Sensitive Files with Credential Data

Status

test

Level

high

Author

Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community

Date

2019-10-22

Modified

2024-06-04

File

rules/windows/process_creation/proc_creation_win_esentutl_sensitive_file_copy.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Files with well-known filenames (sensitive files with credential data) copying

Log source

product

windows

category

process_creation

Detection

selection_esent_img:
    - Image|endswith: '\esentutl.exe'
    - OriginalFileName: '\esentutl.exe'
selection_esent_cli:
    CommandLine|contains|windash:
        - 'vss'
        - ' /m '
        - ' /y '
selection_susp_paths:
    CommandLine|contains:
        - '\config\RegBack\sam'
        - '\config\RegBack\security'
        - '\config\RegBack\system'
        - '\config\sam'
        - '\config\security'
        - '\config\system '        # space needed to avoid false positives with \config\systemprofile\
        - '\repair\sam'
        - '\repair\security'
        - '\repair\system'
        - '\windows\ntds\ntds.dit'
condition: all of selection_esent_* or selection_susp_paths

False positives (as the rule lists them)

• Copying sensitive files for legitimate use (eg. backup) or forensic investigation by legitimate incident responder or forensic investigator.

Tags

• attack.credential-access
• attack.t1003.002
• attack.t1003.003
• car.2013-07-001
• attack.s0404

MITRE ATT&CK ids this rule names

• S0404
• T1003.002
• T1003.003

References

• https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/
• https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
• https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/
• https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Esentutl.yml

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_esentutl_sensitive_file_copy.yml