Windows Security: Network Share Access to Sensitive File Extensions

Alerts when Windows users access network-shared files with extensions commonly targeted for credential or data collection.

FreeUnreviewedSigmamediumv1

windows-security-network-share-access-to-sensitive-file-extensions-91c945bc

title: "Windows Security: Network Share Access to Sensitive File Extensions"
id: a35e29fb-003b-435e-be57-840f2bd70043
related:
  - id: 286b47ed-f6fe-40b3-b3a8-35129acd43bc
    type: similar
  - id: 91c945bc-2ad1-4799-a591-4d00198a1215
    type: derived
status: test
description: This rule flags Windows Security events indicating access to network shares where the accessed object name ends with high-value/sensitive file extensions such as .bak, .dmp, .edb, .kirbi, .msg, .nsf, .pst, .ost, .rdp, and related types. Attackers may use these files to collect credentials, email data, or system/backup artifacts during discovery and collection. It relies on Windows Security EventID 5145 and matches the RelativeTargetName ending with the specified extensions.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_raccess_sensitive_fext.yml
author: Samir Bousseaden, Huntrule Team
date: 2019-04-03
modified: 2025-10-17
tags:
  - attack.collection
  - attack.t1039
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    RelativeTargetName|endswith:
      - .bak
      - .dmp
      - .edb
      - .kirbi
      - .msg
      - .nsf
      - .nst
      - .oab
      - .ost
      - .pst
      - .rdp
  condition: selection
falsepositives:
  - Help Desk operator doing backup or re-imaging end user machine or backup software
  - Users working with these data types or exchanging message files
level: medium
license: DRL-1.1

What it detects

This rule flags Windows Security events indicating access to network shares where the accessed object name ends with high-value/sensitive file extensions such as .bak, .dmp, .edb, .kirbi, .msg, .nsf, .pst, .ost, .rdp, and related types. Attackers may use these files to collect credentials, email data, or system/backup artifacts during discovery and collection. It relies on Windows Security EventID 5145 and matches the RelativeTargetName ending with the specified extensions.

Known false positives

Help Desk operator doing backup or re-imaging end user machine or backup software
Users working with these data types or exchanging message files

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.