mdecrevoisier high experimental sigma

Azure Active Directory Connect credentials dump via network share

Detects scenarios where an attacker attempt to dump Azure Active Directory Connect credentials via network share.

View Source

Detection Logic

{
  "selection": {
    "EventID": 5145,
    "ShareName": "\\\\*\\C$",
    "RelativeTargetName
| contains": "\\Windows\\ServiceProfiles\\ADSync\\AppData\\Local\\Microsoft\\Credentials\\"
  },
  "condition": "selection"
}

False Positives

  • ⚠ None

Field Validations

Loading…

Comments (0)

Loading comments...