sigmahighHunting

Possible Impacket SecretDump Remote Activity

Detect AD credential dumping using impacket secretdump HKTL

MITRE ATT&CK

credential-access

Detection Query

selection:
  EventID: 5145
  ShareName: \\\\\*\\ADMIN$
  RelativeTargetName|contains|all:
    - SYSTEM32\
    - .tmp
condition: selection

Author

Samir Bousseaden, wagga

Created

2019-04-03

Data Sources

windowssecurity

Platforms

windows

References

https://web.archive.org/web/20230329153811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html

Tags

attack.credential-accessattack.t1003.002attack.t1003.004attack.t1003.003

Raw Content

title: Possible Impacket SecretDump Remote Activity
id: 252902e3-5830-4cf6-bf21-c22083dfd5cf
status: test
description: Detect AD credential dumping using impacket secretdump HKTL
references:
    - https://web.archive.org/web/20230329153811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html
author: Samir Bousseaden, wagga
date: 2019-04-03
modified: 2022-08-11
tags:
    - attack.credential-access
    - attack.t1003.002
    - attack.t1003.004
    - attack.t1003.003
logsource:
    product: windows
    service: security
    definition: 'The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure'
detection:
    selection:
        EventID: 5145
        ShareName: '\\\\\*\\ADMIN$'  # looking for the string  \\*\ADMIN$
        RelativeTargetName|contains|all:
            - 'SYSTEM32\'
            - '.tmp'
    condition: selection
falsepositives:
    - Unknown
level: high