Cross-source coverage
T1021.002 / ATT&CK
Remote Services: SMB/Windows Admin Shares
101 rules across 7 sources.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.
SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. Linux and macOS implementations of SMB typically use Samba.
Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. Example network shares include C$, ADMIN$, and IPC$. Adversaries may use this technique in conjunction with administrator-level Valid Accounts to remotely access a networked system over SMB, to interact with systems using remote procedure calls (RPCs), transfer files, and run transferred binaries through remote Execution. Example execution techniques that rely on authenticated sessions over SMB/RPC are Scheduled Task/Job, Service Execution, and Windows Management Instrumentation. Adversaries can also use NTLM hashes to access administrator shares on systems with Pass the Hash and certain configuration and patch levels.
- Tactics
- Lateral Movement
- Platforms
- Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmon
How MITRE says to detect it DET0530
Multi-Event Detection for SMB Admin Share Lateral Movement
Windows Analytic 1468
An SMB-based remote file share access followed by lateral movement actions such as remote service creation, task scheduling, or suspicious process execution on the target host using ADMIN$ or C$ shares.
WinEventLog:SecurityEventCode=4624, 4648WinEventLog:SysmonEventCode=3, 22WinEventLog:SysmonEventCode=1
SigmaHQ/sigma
38 rules| Detection | Severity | Format |
|---|---|---|
| CobaltStrike Service Installations - System | Critical | Sigma |
| Potential DCOM InternetExplorer.Application DLL Hijack | Critical | Sigma |
| Potential DCOM InternetExplorer.Application DLL Hijack - Image Load | Critical | Sigma |
| Turla Group Lateral Movement | Critical | Sigma |
| Wmiprvse Wbemcomn DLL Hijack - File | Critical | Sigma |
| CobaltStrike Service Installations - Security | High | Sigma |
| DCOM InternetExplorer.Application Iertutil DLL Hijack - Security | High | Sigma |
| First Time Seen Remote Named Pipe | High | Sigma |
| First Time Seen Remote Named Pipe - Zeek | High | Sigma |
| HackTool - NetExec File Indicators | High | Sigma |
+ 28 more from SigmaHQ/sigma → showing the 10 highest-severity
elastic/detection-rules
21 rules| Detection | Severity | Format |
|---|---|---|
| Lateral Movement via Startup Folder | High | Elastic TOML |
| Potential Machine Account Relay Attack via SMB | High | Elastic TOML |
| Potential Ransomware Note File Dropped via SMB | High | Elastic TOML |
| Protected Storage Service Access via SMB | High | Elastic TOML |
| Suspicious Execution from a WebDav Share | High | Elastic TOML |
| Suspicious File Renamed via SMB | High | Elastic TOML |
| Mounting Hidden or WebDav Remote Shares | Medium | Elastic TOML |
| NullSessionPipe Registry Modification | Medium | Elastic TOML |
| Potential Lateral Tool Transfer via SMB Share | Medium | Elastic TOML |
| Potential PowerShell HackTool Script by Function Names | Medium | Elastic TOML |
+ 11 more from elastic/detection-rules → showing the 10 highest-severity
splunk/security_content
13 rules| Detection | Severity | Format |
|---|---|---|
| Detect PsExec With accepteula Flag | Undefined | SPL |
| Executable File Written in Administrative SMB Share | Undefined | SPL |
| Impacket Lateral Movement Commandline Parameters | Undefined | SPL |
| Impacket Lateral Movement smbexec CommandLine Parameters | Undefined | SPL |
| Impacket Lateral Movement WMIExec Commandline Parameters | Undefined | SPL |
| SMB Traffic Spike | Undefined | SPL |
| Windows Alternate Data Stream Created Over Local Share | Undefined | SPL |
| Windows PUA Named Pipe | Undefined | SPL |
| Windows RMM Named Pipe | Undefined | SPL |
| Windows Special Privileged Logon On Multiple Hosts | Undefined | SPL |
+ 3 more from splunk/security_content → showing the 10 highest-severity
elastic/protections-artifacts
11 rules| Detection | Severity | Format |
|---|---|---|
| Attempt to Mount a Remote WebDav Share | Undefined | Elastic TOML |
| Execution of a File Dropped from SMB | Undefined | Elastic TOML |
| Execution of a File Dropped from SMB via Services | Undefined | Elastic TOML |
| ImageLoad of a File dropped via SMB | Undefined | Elastic TOML |
| Powershell Execution via Named Pipe | Undefined | Elastic TOML |
| Script Execution from WebDav | Undefined | Elastic TOML |
| Suspicious Credential Files Creation via Kerberos | Undefined | Elastic TOML |
| Suspicious Image Load from SMB Shares | Undefined | Elastic TOML |
| Suspicious NullSessionPipe Registry Modification | Undefined | Elastic TOML |
| Unexpected SMB Connection from User-mode Process | Undefined | Elastic TOML |
+ 1 more from elastic/protections-artifacts → showing the 10 highest-severity
chronicle/detection-rules
10 rules| Detection | Severity | Format |
|---|---|---|
| copy_from_or_to_admin_share_or_sysvol_folder | Medium | YARA-L |
| mitre_attack_T1021_002_windows_admin_share_basic | Low | YARA-L |
| mitre_attack_T1021_002_windows_admin_share_with_asset_entity | Low | YARA-L |
| mitre_attack_T1021_002_windows_admin_share_with_user_enrichment | Low | YARA-L |
| mitre_attack_T1021_002_windows_admin_share_with_user_entity | Low | YARA-L |
| fireeye_red_team_tool__modified_impacket_smbexec_via_cmdline | Undefined | YARA-L |
| fireeye_red_team_tool__modified_impacket_smbexec_via_registry | Undefined | YARA-L |
| mitre_attack_T1021_002_windows_admin_share | Undefined | YARA-L |
| mitre_attack_T1548_002_windows_uac_bypass | Undefined | YARA-L |
| possible_impacketobfuscation_wmiexec_or_smbexec_utility_via_cmdline | Undefined | YARA-L |
Wazuh Core Ruleset
6 rules| Detection | Severity | Format |
|---|---|---|
| New Windows Service Created to start from windows root path. Suspicious event as the binary may have been dropped using Windows Admin Shares. | High | Wazuh XML |
| Amazon Security Lake - VPC - SMB connection established. | Low | Wazuh XML |
| Amazon Security Lake - VPC: SMB connection established. | Low | Wazuh XML |
| A network share was accessed. | Low | Wazuh XML |
| Possible suspicious access to Windows admin shares | Low | Wazuh XML |
| Windows System process activity over SMB port - Possible suspicious access to Windows admin shares | Low | Wazuh XML |
Bert-JanP/Hunting-Queries-Detection-Rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Detect SMB File Copies | Undefined | KQL |
| MITRE ATT&CK Mapping | Undefined | KQL |