Create win_impacket_secretdump.yml

rules/windows/builtin/win_impacket_secretdump.yml

@@ -0,0 +1,21 @@
+title: Possible Impacket SecretDump remote activity
+description: Detect AD credential dumping using impacket secretdump HKTL
+author: Samir Bousseaden
+references:
+    - https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html
+tags:
+    - attack.credential_access
+    - attack.T1003
+logsource:
+    product: windows
+    service: security
+    description: 'The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure'
+detection:
+    selection:
+        EventID: 5145
+        ShareName: \\*\ADMIN$
+        RelativeTargetName: 'SYSTEM32\*.tmp'
+    condition: selection
+falsepositives: 
+    - pentesting
+level: high