Zeek SMB: Network Share File Transfers of Credential-Related Filenames

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags SMB file transfers where the file name matches well-known credential-related or sensitive Windows artifacts (e.g., minidumps, SAM, SECURITY, NTDS.dit). Attackers commonly move these files over network shares to enable offline credential extraction. It relies on Zeek SMB file transfer telemetry from smb_files, specifically the observed file name values included in the transfer events.

Reporting behind it

Related detections9 linkedT1003.002 — drag to rearrange

Windows Credential Dump Tool Artifacts Written to Disk via File Events

Windows Network Share File Transfers Targeting Credential and Memory Dump Paths

Malicious Credential Hive Copy from Volume Shadow Copy

Malicious Mimikatz Credential Access Module Invocation

Windows Print.EXE Sensitive File Dump for Credential Access

Windows PUA: MemProcFS memory dump mounting via -device

Windows File Events: NTDS.DIT Created by Suspicious or Rare Process

Zeek SMB Files: Impacket SecretDump Access to ADMIN$ and System32 .tmp Droppers

Windows Named Pipe Creation for Known Credential Dumping Tool Pipe Names

Zeek SMB: Network Share File Transfers of Credential-Related Filenames

Pivot detection · T1003.002 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

zeek-smb-files-network-share-transfers-of-credential-related-file-names-2e69f167

title: "Zeek SMB: Network Share File Transfers of Credential-Related Filenames"
id: 9f8969b1-8197-45b8-bc7f-c8bf4c234d53
related:
  - id: 910ab938-668b-401b-b08c-b596e80fdca5
    type: similar
  - id: 2e69f167-47b5-4ae7-a390-47764529eff5
    type: derived
status: test
description: This rule flags SMB file transfers where the file name matches well-known credential-related or sensitive Windows artifacts (e.g., minidumps, SAM, SECURITY, NTDS.dit). Attackers commonly move these files over network shares to enable offline credential extraction. It relies on Zeek SMB file transfer telemetry from smb_files, specifically the observed file name values included in the transfer events.
references:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_smb_converted_win_transferring_files_with_credential_data.yml
author: "@neu5ron, Teymur Kheirkhabarov, oscd.community, Huntrule Team"
date: 2020-04-02
modified: 2021-11-27
tags:
  - attack.credential-access
  - attack.t1003.002
  - attack.t1003.001
  - attack.t1003.003
logsource:
  product: zeek
  service: smb_files
detection:
  selection:
    name:
      - \mimidrv
      - \lsass
      - \windows\minidump\
      - \hiberfil
      - \sqldmpr
      - \sam
      - \ntds.dit
      - \security
  condition: selection
falsepositives:
  - Transferring sensitive files for legitimate administration work by legitimate administrator
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL