Possible Impacket Secretdump Remote Activity via SMB
Detects remote credential dumping activity using Impacket's secretdump tool by monitoring SMB file access patterns. Specifically, it looks for access to the ADMIN$ share with paths containing 'SYSTEM32\' and ending with '.tmp', which is characteristic of secretdump creating temporary files during its operation.
Sigma
