Transferring Files with Credential Data via Network Shares - Zeek

Title: Transferring Files with Credential Data via Network Shares - Zeek
Status: test
Description:Transferring files with well-known filenames (sensitive files with credential data) using network shares
References:
  -https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
Author: @neu5ron, Teymur Kheirkhabarov, oscd.community
Date: 2020-04-02
modified:2021-11-27
Tags:

• -'attack.credential-access'
• -'attack.t1003.002'
• -'attack.t1003.001'
• -'attack.t1003.003'

Logsource:

• product: zeek
• service: smb_files

Detection:
  selection:
    name:
      -'\mimidrv'
      -'\lsass'
      -'\windows\minidump\'
      -'\hiberfil'
      -'\sqldmpr'
      -'\sam'
      -'\ntds.dit'
      -'\security'

  condition:selection
Falsepositives:
  -Transferring sensitive files for legitimate administration work by legitimate administrator
Level: medium