SSL Private Key File Copied via SMB

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects attempts to copy SSL private key files over SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings ".key" and "private" (case-insensitive) in the data being sent to the server. This activity could indicate an attacker attempting to exfiltrate sensitive cryptographic material.