Impacket File Indicators for Credential Dumping
Detects the creation of files with specific naming patterns, such as '\sessionresume_[a-zA-Z]{8}$', which are known to be used by the Impacket toolkit, particularly its secretsdump.py module. This activity often indicates an attempt to dump credentials from a compromised system.
Sigma
