Remote Services: SMB/Windows Admin Shares T1021.002

Events covered

34 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 108 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (94 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (915 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (151 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 51 rules

• Access To ADMIN$ Network Share
• CobaltStrike Service Installations - Security
• CobaltStrike Service Installations - System
• Copy From Or To Admin Share Or Sysvol Folder
• DCERPC SMB Spoolss Named Pipe
• DCOM InternetExplorer.Application Iertutil DLL Hijack - Security
• First Time Seen Remote Named Pipe
• First Time Seen Remote Named Pipe - Zeek
• HackTool - NetExec File Indicators
• HackTool - SharpMove Tool Execution
• Impacket PsExec Execution
• Impacket WMIexec execution via SMB admin share
• Lateral movement by mounting a network share - net use (command)
• Lateral movement detection (based on "special groups" feature)
• macOS Network Share Access
• Metasploit Or Impacket Service Installation Via SMB PsExec
• Metasploit SMB Authentication
• Net.EXE Execution
• Network share manipulation via commandline
• New network file share created
• Number of oustanding SMB requests increased
• Password Provided In Command Line Of Net.EXE
• Potential CobaltStrike Service Installations - Registry
• Potential DCOM InternetExplorer.Application DLL Hijack
• Potential DCOM InternetExplorer.Application DLL Hijack - Image Load
• Protected Storage Service Access
• PSexec execution over SMB share
• PUA - CSExec Default Named Pipe
• PUA - RemCom Default Named Pipe
• Remote Service Activity via SVCCTL Named Pipe
• Remote shell execution via SMB admin share
• Rundll32 Execution Without Parameters
• Rundll32 UNC Path Execution
• Shared printer creation (PrintNightmare vulnerability - CVE-2021-36958)
• SMB admin share accessed
• SMB Create Remote File Admin Share
• SMB insecure guest authentication activated (native)
• SMB Spoolss Name Piped Usage
• smbexec.py Service Installation
• Suspicious New-PSDrive to Admin Share
• Suspicious permissions modification on a network share
• Suspicious PsExec Execution
• Suspicious PsExec Execution - Zeek
• T1047 Wmiprvse Wbemcomn DLL Hijack
• Turla Group Lateral Movement
• Unsigned or Unencrypted SMB Connection to Share Established
• Windows Admin Share Mount Via Net.EXE
• Windows Internet Hosted WebDav Share Mount Via Net.EXE
• Windows Share Mount Via Net.EXE
• Wmiprvse Wbemcomn DLL Hijack
• Wmiprvse Wbemcomn DLL Hijack - File

Elastic 21 rules

• Attempt to Mount SMB Share via Command Line
• Lateral Movement via Startup Folder
• Mounting Hidden or WebDav Remote Shares
• NullSessionPipe Registry Modification
• Potential Lateral Tool Transfer via SMB Share
• Potential Machine Account Relay Attack via SMB
• Potential Network Share Discovery
• Potential PowerShell HackTool Script by Function Names
• Potential Ransomware Behavior - Note Files by System
• Potential Ransomware Note File Dropped via SMB
• PsExec Network Connection
• Remote Execution via File Shares
• Remote File Copy to a Hidden Share
• Remote Windows Service Installed
• Service Command Lateral Movement
• SMB Connections via LOLBin or Untrusted Process
• Suspicious Execution from a WebDav Share
• Suspicious File Renamed via SMB
• Suspicious Process Execution via Renamed PsExec Executable
• Suspicious Remote Registry Access via SeBackupPrivilege
• Windows Registry File Creation in SMB Share

Splunk 26 rules

• Detect PsExec With accepteula Flag
• Executable File Written in Administrative SMB Share
• Impacket Lateral Movement Activity (Sysmon)
• Impacket Lateral Movement Activity (Windows Event Log)
• Impacket Lateral Movement Commandline Parameters
• Impacket Lateral Movement smbexec CommandLine Parameters
• Impacket Lateral Movement WMIExec Commandline Parameters
• Net.exe Use with URL (Sysmon)
• Net.exe Use with URL (Windows Event Log)
• Potential EternalBlue via Metasploit (Windows Event Log)
• SMB Traffic Spike
• SMB Write Access on Administrative Share (Windows Event Log)
• Windows Admin$ Share Access (Sysmon)
• Windows Admin$ Share Access (Windows Event Log)
• Windows C$ Share Access (EDR)
• Windows C$ Share Access (Sysmon)
• Windows C$ Share Access (Windows Event Log)
• Windows IPC$ Share Access (Sysmon)
• Windows IPC$ Share Access (Windows Event Log)
• Windows PUA Named Pipe
• Windows RMM Named Pipe
• Windows Share Multiple File Access (Windows Event Log)
• Windows Special Privileged Logon On Multiple Hosts
• Windows Suspicious C2 Named Pipe
• Windows Suspicious Named Pipe
• Windows Theme File Creation in Unusual Location

Kusto 5 rules

• Anomaly in SMB Traffic(ASIM Network Session schema)
• Detect service account login on new device
• Detect Unknown process using SMB or WinRM
• Hunt for ADWS requests from unknown devices
• SMB/Windows Admin Shares

YARA-L 5 rules

• Copy From Or To Admin Share Or Sysvol Folder
• MITRE ATT&CK T1021.002 Windows Admin Share Basic
• MITRE ATT&CK T1021.002 Windows Admin Share With Asset Entity
• MITRE ATT&CK T1021.002 Windows Admin Share With User Enrichment
• MITRE ATT&CK T1021.002 Windows Admin Share With User Entity