RemoteKrbRelay SMB Relay Secrets Dump Module Indicators

SigmaHQ Detections@sigmaHQ

•updated Jun 13, 2025•0•19

Detects the creation of temporary files (sam.tmp, sec.tmp, sys.tmp) in the Windows temporary directory, which are indicators of the RemoteKrbRelay SMB Relay attack module attempting to dump secrets from the Security Account Manager (SAM) and other system hives.