Windows File Creation of RemoteKrbRelay SMB Relay Module Temp Secrets Dumps

title: Windows File Creation of RemoteKrbRelay SMB Relay Module Temp Secrets Dumps
id: 05789919-a7e6-4691-8409-dd3a691e37a4
status: test
description: This rule matches Windows file creation events where the target filename ends with specific temporary files used for secrets dump activity by the RemoteKrbRelay SMB relay module. Attackers may use these module artifacts as staging files to write captured credential material or related outputs. Telemetry relies on Windows file event logs capturing the full target filename/path for the created file.
references:
  - https://github.com/CICADA8-Research/RemoteKrbRelay/blob/19ec76ba7aa50c2722b23359bc4541c0a9b2611c/Exploit/RemoteKrbRelay/Relay/Attacks/RemoteRegistry.cs#L31-L40
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_krbrelay_remote_ioc.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-06-27
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - :\windows\temp\sam.tmp
      - :\windows\temp\sec.tmp
      - :\windows\temp\sys.tmp
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 3ab79e90-9fab-4cdf-a7b2-6522bc742adb
    type: derived