huntrule

Windows Impacket secretsdump sessionresume file creation indicators

Flags Windows file creations of filenames matching Impacket sessionresume pattern ('sessionresume_<8 letters>').

FreeUnreviewedSigmahighv1
title: Windows Impacket secretsdump sessionresume file creation indicators
id: 1f0a0f35-1d2b-4e6a-bdda-c2d2b2de9028
related:
  - id: 6e2a900a-ced9-4e4a-a9c2-13e706f9518a
    type: similar
  - id: 03f4ca17-de95-428d-a75a-4ee78b047256
    type: derived
status: experimental
description: "This rule identifies Windows file creation events where the target filename matches an Impacket-related sessionresume pattern: '\\sessionresume_[a-zA-Z]{8}'. Attackers may use Impacket utilities to collect credentials, and these transient session files can provide a useful observable for early detection. It relies on telemetry that records file event target filenames for process-driven file creation."
references:
  - https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/
  - https://github.com/fortra/impacket
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_impacket_file_indicators.yml
author: The DFIR Report, IrishDeath, Huntrule Team
date: 2025-05-19
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  category: file_event
detection:
  selection_names_re:
    TargetFilename|re: \\sessionresume_[a-zA-Z]{8}$
  condition: selection_names_re
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule identifies Windows file creation events where the target filename matches an Impacket-related sessionresume pattern: '\sessionresume_[a-zA-Z]{8}'. Attackers may use Impacket utilities to collect credentials, and these transient session files can provide a useful observable for early detection. It relies on telemetry that records file event target filenames for process-driven file creation.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.