Suspicious Access to Sensitive File Extensions via SMB

SigmaHQ Detections@sigmaHQ

•updated Oct 17, 2025•0•25

This rule detects suspicious access to files with sensitive extensions commonly associated with email archives, database files, memory dumps, and remote desktop connection files. Monitoring access to these file types can indicate attempts at data collection, credential dumping, or lateral movement preparation by adversaries.