Possible Impacket SecretDump Remote Activity - Zeek

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml