Transferring Files with Credential Data via Network Shares

Title: Transferring Files with Credential Data via Network Shares
Status: test
Description:Transferring files with well-known filenames (sensitive files with credential data) using network shares
References:
  -https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
Author: Teymur Kheirkhabarov, oscd.community
Date: 2019-10-22
modified:2025-07-11
Tags:

• -'attack.credential-access'
• -'attack.t1003.002'
• -'attack.t1003.001'
• -'attack.t1003.003'

Logsource:

• product: windows
• service: security

Detection:
  selection_eid:
    EventID: '5145'
  selection_object:
    - RelativeTargetName|contains:
      - '\mimidrv'
      - '\lsass'
      - '\windows\minidump\'
      - '\hiberfil'
      - '\sqldmpr'
    - RelativeTargetName:
      - 'Windows\NTDS\ntds.dit'
      - 'Windows\System32\config\SAM'
      - 'Windows\System32\config\SECURITY'
      - 'Windows\System32\config\SYSTEM'
  condition:all of selection_*
Falsepositives:
  -Transferring sensitive files for legitimate administration work by legitimate administrator
Level: medium