HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump — Detection Rule

Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.

Read the full analysis on IntelFusions