Windows File Events: CrackMapExec or Impacket-secretsdump Credential Dumping Temp Output

title: "Windows File Events: CrackMapExec or Impacket-secretsdump Credential Dumping Temp Output"
id: 61d855f3-a59a-426e-941e-682b1a0409e4
status: test
description: This rule flags Windows file creation events where the target filename matches the typical temp naming pattern used during remote credential dumping workflows. Attackers commonly use tools such as CrackMapExec or Impacket-secretsdump to collect credential material from remote systems, and the resulting files can expose that activity. The detection relies on file event telemetry for TargetFilename matching the specified pattern and the associated process image ending in \svchost.exe.
references:
  - https://github.com/Porchetta-Industries/CrackMapExec
  - https://github.com/fortra/impacket/blob/ff8c200fd040b04d3b5ff05449646737f836235d/examples/secretsdump.py
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_remote_cred_dump.yml
author: SecurityAura, Huntrule Team
date: 2022-11-16
modified: 2024-06-27
tags:
  - attack.credential-access
  - attack.t1003
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith: \svchost.exe
    TargetFilename|re: \\Windows\\System32\\[a-zA-Z0-9]{8}\.tmp$
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 6e2a900a-ced9-4e4a-a9c2-13e706f9518a
    type: derived