mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-06 09:25:17 +00:00
16 lines
376 B
YAML
16 lines
376 B
YAML
alert:
|
|
- debug
|
|
description: Detect AD credential dumping using impacket secretdump HKTL
|
|
filter:
|
|
- query:
|
|
query_string:
|
|
query: (data.win.system.eventID:"5145" AND share_name.keyword:\\*\\ADMIN$ AND share_relative_target_name.keyword:SYSTEM32\\*.tmp)
|
|
index: wazuh-alerts-3.x-*
|
|
name: 252902e3-5830-4cf6-bf21-c22083dfd5cf_0
|
|
priority: 2
|
|
realert:
|
|
minutes: 0
|
|
type: any
|
|
|
|
|