Suspicious Transferring Files with Credential Data through Network Shares - Zeek (via smb_files)

title: Suspicious Transferring Files with Credential Data through Network Shares - Zeek (via smb_files)
id: f30ef9aa-ffc5-5962-a7a6-4f57dcc8ebac
status: stable
description: This rule detects transferring files with well-known filenames (sensitive files with credential data) using network shares
references:
    - https://attack.mitre.org/techniques/T1003/003/
    - https://attack.mitre.org/techniques/T1003/001/
    - https://attack.mitre.org/techniques/T1003/002/
    - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
author: 'Huntrule Team'
date: 2026-01-20
tags:
    - attack.credential-access
    - attack.t1003.002
    - attack.t1003.001
    - attack.t1003.003
logsource:
    product: zeek
    service: smb_files
detection:
    selection:
        name:
            - '\mimidrv'
            - '\lsass'
            - '\windows\minidump\'
            - '\hiberfil'
            - '\sqldmpr'
            - '\sam'
            - '\ntds.dit'
            - '\security'
    condition: selection
falsepositives:
    - Unknown
level: medium