
title: Transferring Files with Credential Data via Network Shares
author: Teymur Kheirkhabarov, oscd.community
date: 2019/10/22
description: Transferring files with well-known filenames (sensitive files with credential
  data) using network shares
detection:
  SELECTION_1:
    EventID: 5145
  SELECTION_2:
    RelativeTargetName:
    - '*\mimidrv*'
    - '*\lsass*'
    - '*\windows\minidump\\*'
    - '*\hiberfil*'
    - '*\sqldmpr*'
    - '*\sam*'
    - '*\ntds.dit*'
    - '*\security*'
  condition: (SELECTION_1 and SELECTION_2)
falsepositives:
- Transferring sensitive files for legitimate administration work by legitimate administrator
id: 910ab938-668b-401b-b08c-b596e80fdca5
level: medium
logsource:
  product: windows
  service: security
references:
- https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
status: experimental
tags:
- attack.credential_access
- attack.t1003
- attack.t1003.002
- attack.t1003.001
- attack.t1003.003
ruletype: SIGMA
