Possible Impacket SecretDump Remote Activity — Detection Rule

Detect AD credential dumping using impacket secretdump HKTL

Read the full analysis on IntelFusions