Zeek SMB Files: Network Share Transfers of Credential-Related File Names

Flags Zeek-observed SMB share file transfers involving credential/dump-related filenames.

FreeUnreviewedSigmamediumv1

zeek-smb-files-network-share-transfers-of-credential-related-file-names-2e69f167

title: "Zeek SMB Files: Network Share Transfers of Credential-Related File Names"
id: 9f8969b1-8197-45b8-bc7f-c8bf4c234d53
related:
  - id: 910ab938-668b-401b-b08c-b596e80fdca5
    type: similar
  - id: 2e69f167-47b5-4ae7-a390-47764529eff5
    type: derived
status: test
description: This rule flags SMB file transfers in Zeek where the file name matches well-known credential-related artifacts (e.g., lsass, sam, security, ntds.dit) or common dump paths. Attackers often exfiltrate sensitive credential material by copying it to network shares to evade local controls and simplify collection. The detection relies on Zeek SMB file telemetry that records the transferred file names/paths involved in the share activity.
references:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_smb_converted_win_transferring_files_with_credential_data.yml
author: "@neu5ron, Teymur Kheirkhabarov, oscd.community, Huntrule Team"
date: 2020-04-02
modified: 2021-11-27
tags:
  - attack.credential-access
  - attack.t1003.002
  - attack.t1003.001
  - attack.t1003.003
logsource:
  product: zeek
  service: smb_files
detection:
  selection:
    name:
      - \mimidrv
      - \lsass
      - \windows\minidump\
      - \hiberfil
      - \sqldmpr
      - \sam
      - \ntds.dit
      - \security
  condition: selection
falsepositives:
  - Transferring sensitive files for legitimate administration work by legitimate administrator
level: medium
license: DRL-1.1

What it detects

This rule flags SMB file transfers in Zeek where the file name matches well-known credential-related artifacts (e.g., lsass, sam, security, ntds.dit) or common dump paths. Attackers often exfiltrate sensitive credential material by copying it to network shares to evade local controls and simplify collection. The detection relies on Zeek SMB file telemetry that records the transferred file names/paths involved in the share activity.

Known false positives

Transferring sensitive files for legitimate administration work by legitimate administrator

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.