Zeek SMB Files: Impacket SecretDump Access to ADMIN$ and System32 .tmp Droppers

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags remote activity consistent with Impacket SecretDump attempts by identifying SMB file operations that access ADMIN$ and touch files under SYSTEM32 ending with .tmp. Such behavior matters because it can indicate credential dumping staging on a target host. Telemetry relies on Zeek SMB file logs capturing the requested path, file name, and extensions used during the operation.

Reporting behind it

Related detections9 linkedT1003.002 — drag to rearrange

Windows Credential Dump Tool Artifacts Written to Disk via File Events

Malicious Credential Hive Copy from Volume Shadow Copy

Windows Print.EXE Sensitive File Dump for Credential Access

Windows PUA: MemProcFS memory dump mounting via -device

Windows File Events: NTDS.DIT Created by Suspicious or Rare Process

Zeek SMB: Network Share File Transfers of Credential-Related Filenames

Windows Named Pipe Creation for Known Credential Dumping Tool Pipe Names

Windows Volume Shadow Copy Symlink Creation Using mklink

Windows Network Share File Transfers Targeting Credential and Memory Dump Paths

Zeek SMB Files: Impacket SecretDump Access to ADMIN$ and System32 .tmp Droppers

Pivot detection · T1003.002 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

zeek-smb-files-impacket-secretdump-activity-via-admin-and-system32-tmp-drops-92dae1ed

title: "Zeek SMB Files: Impacket SecretDump Access to ADMIN$ and System32 .tmp Droppers"
id: 7afc5219-e015-41ad-83b4-cc4e675805ce
status: test
description: This rule flags remote activity consistent with Impacket SecretDump attempts by identifying SMB file operations that access ADMIN$ and touch files under SYSTEM32 ending with .tmp. Such behavior matters because it can indicate credential dumping staging on a target host. Telemetry relies on Zeek SMB file logs capturing the requested path, file name, and extensions used during the operation.
references:
  - https://web.archive.org/web/20230329153811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_smb_converted_win_impacket_secretdump.yml
author: Samir Bousseaden, @neu5ron, Huntrule Team
date: 2020-03-19
modified: 2021-11-27
tags:
  - attack.credential-access
  - attack.t1003.002
  - attack.t1003.004
  - attack.t1003.003
logsource:
  product: zeek
  service: smb_files
detection:
  selection:
    path|contains|all:
      - \
      - ADMIN$
    name|contains: SYSTEM32\
    name|endswith: .tmp
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 92dae1ed-1c9d-4eff-a567-33acbd95b00e
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL