Windows Network Share File Transfers Targeting Credential and Memory Dump Paths
Alerts on network share access to credential-related files using Windows Security Event 5145.
- Product
- windows
- Service
- security
- Author
- Teymur Kheirkhabarov, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-10-22
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
Identifies Windows Security event 5145 instances where a process transfers files over a network share and the target path includes well-known credential or memory-dump related filenames and directories (e.g., lsass, minidump, hiberfil, SAM/SECURITY/SYSTEM/NTDS.dit, sqldmpr). This matters because attackers commonly exfiltrate or stage sensitive credential material using standard file transfer mechanisms, blending into normal share access. The rule relies on Windows Security auditing for share access events that include RelativeTargetName values matching the specified sensitive paths.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Network Share File Transfers Targeting Credential and Memory Dump Paths
id: 7ab86734-451f-48e6-9b34-ca40f2466824
related:
- id: 2e69f167-47b5-4ae7-a390-47764529eff5
type: similar
- id: 910ab938-668b-401b-b08c-b596e80fdca5
type: derived
status: test
description: Identifies Windows Security event 5145 instances where a process transfers files over a network share and the target path includes well-known credential or memory-dump related filenames and directories (e.g., lsass, minidump, hiberfil, SAM/SECURITY/SYSTEM/NTDS.dit, sqldmpr). This matters because attackers commonly exfiltrate or stage sensitive credential material using standard file transfer mechanisms, blending into normal share access. The rule relies on Windows Security auditing for share access events that include RelativeTargetName values matching the specified sensitive paths.
references:
- https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_transf_files_with_cred_data_via_network_shares.yml
author: Teymur Kheirkhabarov, oscd.community, Huntrule Team
date: 2019-10-22
modified: 2025-07-11
tags:
- attack.credential-access
- attack.t1003.002
- attack.t1003.001
- attack.t1003.003
logsource:
product: windows
service: security
detection:
selection_eid:
EventID: 5145
selection_object:
- RelativeTargetName|contains:
- \mimidrv
- \lsass
- \windows\minidump\
- \hiberfil
- \sqldmpr
- RelativeTargetName:
- Windows\NTDS\ntds.dit
- Windows\System32\config\SAM
- Windows\System32\config\SECURITY
- Windows\System32\config\SYSTEM
condition: all of selection_*
falsepositives:
- Transferring sensitive files for legitimate administration work by legitimate administrator
level: medium
license: DRL-1.1