Query: Sigma YAML for zeek / smb_files
Matching passage: Sigma rule: Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secre. Logsource: zeek / smb_files. Rule: title: Possible Impacket SecretDump Remote Activity - Zeek id: 92dae1ed-1c9d-4eff-a567-33acbd95b00e status: test description: Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml references: - https://web.archive.org/web/20230329153811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html author: Samir Bousseaden, @neu5ron date: 2020-03-19 modified: 2021-11-27 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.004 - attack.t1003.003 logsource: product: zeek service: smb_files detection: selection: path|contains|all: - \ - ADMIN$ name|contains: SYSTEM32\ name|endswith: .tmp condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may. Logsource: windows / process_creation. Rule: title: Script Interpreter Execution From Suspicious Folder id: 1228c958-e64e-4e71-92ad-7d429f4138ba status: test description: 'Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity. Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts. ' references: - https://www.virustotal.com/gui/file/91ba814a86ddedc7a9d546e26f912c541205b47a853d227756ab1334ade92c3f - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-russia-ukraine-military - https://learn.microsoft.com/en-us/windows/win32/shell/csidl author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-02-08 modified: 2026-02-17 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_proc_image: Image|endswith: - \cscript.exe - \mshta.exe - \wscript.exe selection_proc_flags: CommandLine|contains: - ' -ep bypass ' - ' -ExecutionPolicy bypass ' - ' -w hidden ' - '/e:javascript ' - '/e:Jscript ' - '/e:vbscript ' selection_proc_original: OriginalFileName: - cscript.exe - mshta.exe - wscript.exe selection_folders_1: CommandLine|contains: - :\Perflogs\ - :\Users\Public\ - \%Public% - \AppData\Local\Temp - \AppData\Roaming\Temp - \Temporary Internet - \Windows\Temp - \Start Menu\Programs\Startup\ - '%TEMP%' - '%TMP%' - '%LocalAppData%\Temp' selection_folders_2: - CommandLine|contains|all: - :\Users\ - \Favorites\ - CommandLine|contains|all: - :\Users\ - \Favourites\ - CommandLine|contains|all: - :\Users\ - \Contacts\ - CommandLine|contains|all: - :\Users\ - \Documents\ - CommandLine|contains|all: - :\Users\ - \Music\ - CommandLine|contains|all: - :\Users\ - \Pictures\ - CommandLine|contains|all: - :\Users\ - \Videos\ filter_optional_chocolatey_installer: ParentImage: - C:\Windows\System32\Msiexec.exe - C:\Windows\SysWOW64\Msiexec.exe Image|endswith: \powershell.exe CommandLine|contains|all: - -NoProfile -ExecutionPolicy Bypass -Command - AppData\Local\Temp\ - Install-Chocolatey.ps1 condition: 1 of selection_proc_* and 1 of selection_folders_* and not 1 of filter_optional_* falsepositives: - Various legitimate software have been observed to use similar techniques for installation or update purposes;thus, it is recommended to review and tune filters for your environme