User files dump via network share (DonPapi, Lazagne)

Status: experimental
Severity: high
Time window: 5m
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempt to dump user profile information via network share.

Known false positives

Roaming user profile, vulnerability scanners

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1555` Credentials from Password Stores

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 5145: A network share object was checked to see whether client can be granted desired access.

Rule body

title: User files dump via network share (DonPapi, Lazagne)
description: Detects scenarios where an attacker attempt to dump user profile information via network share.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1555-Credentials%20from%20Password%20Stores
- https://github.com/login-securite/DonPAPI
tags:
- attack.credential_access
- attack.t1555
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    ShareName: '\\*\C$'
    RelativeTargetName|re:
      - Users\\.*\\Desktop.*
      - Users\\.*\\Recent.*
      - Users\\.*\\Downloads.*
      #- Users\\.* # More broader filter
  filter:
    - RelativeTargetName|re: Users\\.*\\AppData\\.* # handled in another rule
    - IpAddress:
      - '%vulnerability_scanners%'
      - '%admin_netork_administration%'
  condition: selection and not filter | count(RelativeTargetName) by Computer > 15 # Counting over different user names in the path can also decrease false positives
  timeframe: 5m
falsepositives:
- Roaming user profile, vulnerability scanners
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter | count(RelativeTargetName) by Computer > 15 # Counting over different user names in the path can also decrease false positives

Stage 1: `selection`

selection:
  EventID: 5145
  ShareName: '\\*\C$'
  RelativeTargetName|re:
    - Users\\.*\\Desktop.*
    - Users\\.*\\Recent.*
    - Users\\.*\\Downloads.*

Threshold: > 15

Stage 2: `not filter`

filter:
  - RelativeTargetName|re: Users\\.*\\AppData\\.*
  - IpAddress:
    - '%vulnerability_scanners%'
    - '%admin_netork_administration%'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`IpAddress`	eq	`%admin_netork_administration%`	`excludes:IpAddress` `field:"IpAddress" value:"%admin_netork_administration%"`
`IpAddress`	eq	`%vulnerability_scanners%`	`excludes:IpAddress` `field:"IpAddress" value:"%vulnerability_scanners%"`
`RelativeTargetName`	regex_match	`Users\.\AppData\.`	`excludes:RelativeTargetName` `field:"RelativeTargetName" value:"Users\.\AppData\."`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`RelativeTargetName`	regex_match	`Users\.\Desktop.` `Users\.\Downloads.` `Users\.\Recent.`	`field:"RelativeTargetName" kind:regex_match`
`ShareName`	wildcard	`\\*\C$` corpus 7 (sigma 7)	`field:"ShareName" kind:wildcard value:"\\*\C$"`

User files dump via network share (DonPapi, Lazagne)

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Stage 2: not filter

Exclusions

Indicators

Stage 0: `condition`

Stage 1: `selection`

Stage 2: `not filter`