Zeek SMB Files: Impacket SecretDump Activity via ADMIN$ and SYSTEM32 .tmp Drops

title: "Zeek SMB Files: Impacket SecretDump Activity via ADMIN$ and SYSTEM32 .tmp Drops"
id: 7afc5219-e015-41ad-83b4-cc4e675805ce
status: test
description: This rule flags remote credential-dumping behavior consistent with Impacket SecretDump by matching Zeek SMB file activity involving the ADMIN$ share and temporary .tmp files under SYSTEM32. Attackers may use this pattern to stage or interact with system files on a target during dump operations. It relies on Zeek SMB file telemetry that includes file paths, share identifiers, and filenames.
references:
  - https://web.archive.org/web/20230329153811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_smb_converted_win_impacket_secretdump.yml
author: Samir Bousseaden, @neu5ron, Huntrule Team
date: 2020-03-19
modified: 2021-11-27
tags:
  - attack.credential-access
  - attack.t1003.002
  - attack.t1003.004
  - attack.t1003.003
logsource:
  product: zeek
  service: smb_files
detection:
  selection:
    path|contains|all:
      - \
      - ADMIN$
    name|contains: SYSTEM32\
    name|endswith: .tmp
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 92dae1ed-1c9d-4eff-a567-33acbd95b00e
    type: derived