Possible Impacket secretdump Remote Activity
Detects attempts to dump Active Directory credentials using Impacket's secretdump tool. This rule specifically looks for Event ID 5145 (A network share object was checked to see whether client can be granted desired access) on the ADMIN$ share, combined with access to a temporary file within the SYSTEM32 directory. This pattern is indicative of secretdump's remote activity to extract credential hashes.
Sigma
