Transferring Files with Credential Data via Network Shares
This rule detects attempts to transfer sensitive files containing credential data via network shares. It specifically looks for Event ID 5145 (A network share object was checked to see whether client can be granted desired access) and checks if the 'RelativeTargetName' of the accessed object contains well-known filenames or paths associated with credential storage, such as Mimikatz output, LSASS memory dumps, Windows minidumps, hibernation files, SQL dumps, or critical system files like NTDS.dit, SAM, SECURITY, and SYSTEM hives.
Sigma
