Zeek SMB File Activity: Access to Sensitive Email, Database, Backup, and Credential Extensions

Alerts on Zeek-observed SMB file accesses to filenames ending with high-value sensitive extensions.

FreeUnreviewedSigmamediumv1

zeek-smb-file-activity-access-to-sensitive-email-database-backup-and-credential--286b47ed

title: "Zeek SMB File Activity: Access to Sensitive Email, Database, Backup, and Credential Extensions"
id: 7e12a0c6-225f-4bcf-8486-bf6baa52b429
related:
  - id: 91c945bc-2ad1-4799-a591-4d00198a1215
    type: derived
  - id: 286b47ed-f6fe-40b3-b3a8-35129acd43bc
    type: derived
status: test
description: This rule flags SMB file activity in Zeek where the accessed filename ends with a set of sensitive extensions (e.g., .pst, .ost, .msg, .oab, .edb, .nsf, .bak, .dmp, .kirbi, .rdp). Such file types are commonly targeted for data theft, credential-related material, or backup/forensic data collection. It relies on Zeek SMB file logs that provide file names so the detection can match extension suffixes.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_smb_converted_win_susp_raccess_sensitive_fext.yml
author: Samir Bousseaden, @neu5ron, Huntrule Team
date: 2020-04-02
modified: 2025-10-17
tags:
  - attack.collection
logsource:
  product: zeek
  service: smb_files
detection:
  selection:
    name|endswith:
      - .pst
      - .ost
      - .msg
      - .nst
      - .oab
      - .edb
      - .nsf
      - .bak
      - .dmp
      - .kirbi
      - .rdp
  condition: selection
falsepositives:
  - Help Desk operator doing backup or re-imaging end user machine or backup software
  - Users working with these data types or exchanging message files
level: medium
license: DRL-1.1

What it detects

This rule flags SMB file activity in Zeek where the accessed filename ends with a set of sensitive extensions (e.g., .pst, .ost, .msg, .oab, .edb, .nsf, .bak, .dmp, .kirbi, .rdp). Such file types are commonly targeted for data theft, credential-related material, or backup/forensic data collection. It relies on Zeek SMB file logs that provide file names so the detection can match extension suffixes.

Known false positives

Help Desk operator doing backup or re-imaging end user machine or backup software
Users working with these data types or exchanging message files

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.