copying sensitive files for legitimate use (eg. backup) or forensic investigation by legitimate incident responder or forensic invetigator

t1003
t1003.002
t1003.003
windows
sigma

Techniques

t1003
t1003.002
t1003.003

Sample rules

Copying Sensitive Files with Credential Data

source: sigma
technicques:
- t1003
- t1003.002
- t1003.003

Description

Files with well-known filenames (sensitive files with credential data) copying

Detection logic

condition: all of selection_esent_* or selection_susp_paths
selection_esent_cli:
  CommandLine|contains:
  - vss
  - ' /m '
  - ' /y '
selection_esent_img:
- Image|endswith: \esentutl.exe
- OriginalFileName: \esentutl.exe
selection_susp_paths:
  CommandLine|contains:
  - \windows\ntds\ntds.dit
  - \config\sam
  - \config\security
  - '\config\system '
  - \repair\sam
  - \repair\system
  - \repair\security
  - \config\RegBack\sam
  - \config\RegBack\system
  - \config\RegBack\security