Copying Sensitive Files with Credential Data

Title: Copying Sensitive Files with Credential Data
Status: test
Description:Files with well-known filenames (sensitive files with credential data) copying
References:
  -https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/
  -https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  -https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/
  -https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Esentutl.yml
Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
Date: 2019-10-22
modified:2024-06-04
Tags:

• -'attack.credential-access'
• -'attack.t1003.002'
• -'attack.t1003.003'
• -'car.2013-07-001'
• -'attack.s0404'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_esent_img:
Image|endswith:'\esentutl.exe' OriginalFileName:'\esentutl.exe'   selection_esent_cli:
    CommandLine|contains|windash:
      -'vss'
      -' /m '
      -' /y '

  selection_susp_paths:
    CommandLine|contains:
      -'\config\RegBack\sam'
      -'\config\RegBack\security'
      -'\config\RegBack\system'
      -'\config\sam'
      -'\config\security'
      -'\config\system '
      -'\repair\sam'
      -'\repair\security'
      -'\repair\system'
      -'\windows\ntds\ntds.dit'

  condition:all of selection_esent_* or selection_susp_paths
Falsepositives:
  -Copying sensitive files for legitimate use (eg. backup) or forensic investigation by legitimate incident responder or forensic investigator.
Level: high