Windows Security Event 5145 Credential File Transfers via Network Shares

Alerts on network share access to credential-related files using Windows Security Event 5145.

FreeUnreviewedSigmamediumv1

windows-security-event-5145-credential-file-transfers-via-network-shares-910ab938

title: Windows Security Event 5145 Credential File Transfers via Network Shares
id: 7ab86734-451f-48e6-9b34-ca40f2466824
related:
  - id: 2e69f167-47b5-4ae7-a390-47764529eff5
    type: similar
  - id: 910ab938-668b-401b-b08c-b596e80fdca5
    type: derived
status: test
description: This rule flags file transfer activity over network shares using Windows Security Event ID 5145 when the target path/name matches common credential and dump artifacts (e.g., NTDS database, SAM/SECURITY/SYSTEM hives, minidumps, and LSASS/hiberfil-related targets). Attackers often stage or exfiltrate sensitive credential material through shared storage to move harvested secrets off the host. The detection relies on audit telemetry for share access events that include the RelativeTargetName being accessed.
references:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_transf_files_with_cred_data_via_network_shares.yml
author: Teymur Kheirkhabarov, oscd.community, Huntrule Team
date: 2019-10-22
modified: 2025-07-11
tags:
  - attack.credential-access
  - attack.t1003.002
  - attack.t1003.001
  - attack.t1003.003
logsource:
  product: windows
  service: security
detection:
  selection_eid:
    EventID: 5145
  selection_object:
    - RelativeTargetName|contains:
        - \mimidrv
        - \lsass
        - \windows\minidump\
        - \hiberfil
        - \sqldmpr
    - RelativeTargetName:
        - Windows\NTDS\ntds.dit
        - Windows\System32\config\SAM
        - Windows\System32\config\SECURITY
        - Windows\System32\config\SYSTEM
  condition: all of selection_*
falsepositives:
  - Transferring sensitive files for legitimate administration work by legitimate administrator
level: medium
license: DRL-1.1

What it detects

This rule flags file transfer activity over network shares using Windows Security Event ID 5145 when the target path/name matches common credential and dump artifacts (e.g., NTDS database, SAM/SECURITY/SYSTEM hives, minidumps, and LSASS/hiberfil-related targets). Attackers often stage or exfiltrate sensitive credential material through shared storage to move harvested secrets off the host. The detection relies on audit telemetry for share access events that include the RelativeTargetName being accessed.

Known false positives

Transferring sensitive files for legitimate administration work by legitimate administrator

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.