Zeek SMB File Access to Sensitive Email/Database/Backup Extensions
Alerts on Zeek-observed SMB file accesses to filenames ending with high-value sensitive extensions.
FreeReviewedSigma · Medium · v2
- Product
- zeek
- Service
- smb_files
- Author
- Samir Bousseaden, @neu5ron (SigmaHQ), DRL 1.1
- Published
- 2020-04-02
- Updated
- 2026-07-31
What it detects
This rule flags SMB file accesses in Zeek logs where the accessed filename ends with a set of sensitive or high-value extensions (e.g., PST/OST/MSG, EDB/NSF, backup and dump files). Attackers often use file discovery and collection to gather sensitive data such as mailboxes, credentials-related artifacts, databases, and system dumps. The detection relies on Zeek SMB file event telemetry that includes the accessed file name and supports suffix matching.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
zeek-smb-file-activity-access-to-sensitive-email-database-backup-and-credential--286b47ed
title: Zeek SMB File Access to Sensitive Email/Database/Backup Extensions
id: 7e12a0c6-225f-4bcf-8486-bf6baa52b429
related:
- id: 91c945bc-2ad1-4799-a591-4d00198a1215
type: derived
- id: 286b47ed-f6fe-40b3-b3a8-35129acd43bc
type: derived
status: test
description: This rule flags SMB file accesses in Zeek logs where the accessed filename ends with a set of sensitive or high-value extensions (e.g., PST/OST/MSG, EDB/NSF, backup and dump files). Attackers often use file discovery and collection to gather sensitive data such as mailboxes, credentials-related artifacts, databases, and system dumps. The detection relies on Zeek SMB file event telemetry that includes the accessed file name and supports suffix matching.
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_smb_converted_win_susp_raccess_sensitive_fext.yml
author: Samir Bousseaden, @neu5ron, Huntrule Team
date: 2020-04-02
modified: 2025-10-17
tags:
- attack.collection
logsource:
product: zeek
service: smb_files
detection:
selection:
name|endswith:
- .pst
- .ost
- .msg
- .nst
- .oab
- .edb
- .nsf
- .bak
- .dmp
- .kirbi
- .rdp
condition: selection
falsepositives:
- Help Desk operator doing backup or re-imaging end user machine or backup software
- Users working with these data types or exchanging message files
level: medium
license: DRL-1.1