Windows Impacket-Pattern File Creation: sessionresume_[a-zA-Z]{8} Indicator

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.001LSASS Memory
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows file creation events where the target filename matches a specific Impacket-related pattern: sessionresume_[a-zA-Z]{8}. Such files can be used as artifacts during credential access and other post-compromise activity, making them useful indicators of automated tooling. It relies on Windows file event telemetry that includes the created target filename and supports regex-based matching on the name.

Reporting behind it

Related detections9 linkedT1003.001 — drag to rearrange

Malicious WDigest Credential Caching Enabled via Registry (via registry_set)

Malicious Credential Dumping via Mimikatz Sekurlsa Command

Malicious Mimikatz Sekurlsa Logonpasswords Credential Dump

Malicious LSASS Credential Dump via ProcDump (via process_creation)

Malicious LSASS Memory Dump via comsvcs.dll by Salt Typhoon

Malicious LSASS Dump via Process Access (via process_access)

Malicious LSASS Credential Dump with LSASSY - Process (via process_creation)

Malicious LSASS Credential Dump with LSASSY - Admin Share (via security)

Malicious Task Manager Used for LSASS Dump - Kernel (via security)

Windows Impacket-Pattern File Creation: sessionresume_[a-zA-Z]{8} Indicator

Pivot detection · T1003.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-impacket-secretsdump-sessionresume-file-creation-indicators-03f4ca17

title: "Windows Impacket-Pattern File Creation: sessionresume_[a-zA-Z]{8} Indicator"
id: 1f0a0f35-1d2b-4e6a-bdda-c2d2b2de9028
related:
  - id: 6e2a900a-ced9-4e4a-a9c2-13e706f9518a
    type: similar
  - id: 03f4ca17-de95-428d-a75a-4ee78b047256
    type: derived
status: experimental
description: "This rule flags Windows file creation events where the target filename matches a specific Impacket-related pattern: sessionresume_[a-zA-Z]{8}. Such files can be used as artifacts during credential access and other post-compromise activity, making them useful indicators of automated tooling. It relies on Windows file event telemetry that includes the created target filename and supports regex-based matching on the name."
references:
  - https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/
  - https://github.com/fortra/impacket
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_impacket_file_indicators.yml
author: The DFIR Report, IrishDeath, Huntrule Team
date: 2025-05-19
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  product: windows
  category: file_event
detection:
  selection_names_re:
    TargetFilename|re: \\sessionresume_[a-zA-Z]{8}$
  condition: selection_names_re
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL