Phoenix
Sigma IntelligenceBeta
Rule Library

Sigma Rules

1 rule found for "SecurityAura"

3,707Total
3,116Detection
451Emerging
137Hunting
Detectionhightest

HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump

Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.

WindowsFile Event
TA0006 · Credential AccessT1003 · OS Credential Dumping
SecurityAuraWed Nov 16windows