KeePass Database File Copied via SMB

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects when a KeePass database file (.kdbx) is copied to a server via SMB. This could indicate an attempt to exfiltrate sensitive credential data.