Zeek SMB Files: Impacket SecretDump Access to ADMIN$ and System32 .tmp Droppers
Alerts on Zeek SMB file events suggesting Impacket SecretDump-style staging in ADMIN$ under SYSTEM32 with .tmp files.
- Product
- zeek
- Service
- smb_files
- Author
- Samir Bousseaden, @neu5ron (SigmaHQ), DRL 1.1
- Published
- 2020-03-19
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags remote activity consistent with Impacket SecretDump attempts by identifying SMB file operations that access ADMIN$ and touch files under SYSTEM32 ending with .tmp. Such behavior matters because it can indicate credential dumping staging on a target host. Telemetry relies on Zeek SMB file logs capturing the requested path, file name, and extensions used during the operation.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Zeek SMB Files: Impacket SecretDump Access to ADMIN$ and System32 .tmp Droppers"
id: 7afc5219-e015-41ad-83b4-cc4e675805ce
status: test
description: This rule flags remote activity consistent with Impacket SecretDump attempts by identifying SMB file operations that access ADMIN$ and touch files under SYSTEM32 ending with .tmp. Such behavior matters because it can indicate credential dumping staging on a target host. Telemetry relies on Zeek SMB file logs capturing the requested path, file name, and extensions used during the operation.
references:
- https://web.archive.org/web/20230329153811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_smb_converted_win_impacket_secretdump.yml
author: Samir Bousseaden, @neu5ron, Huntrule Team
date: 2020-03-19
modified: 2021-11-27
tags:
- attack.credential-access
- attack.t1003.002
- attack.t1003.004
- attack.t1003.003
logsource:
product: zeek
service: smb_files
detection:
selection:
path|contains|all:
- \
- ADMIN$
name|contains: SYSTEM32\
name|endswith: .tmp
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 92dae1ed-1c9d-4eff-a567-33acbd95b00e
type: derived