Detection rules › Kusto
Detect Unknown process using SMB or WinRM
WinRM and SMB are popular network protocols to perform lateral movement by adversaries (while there are some others as well). When an unknown process is performing SMB or WinRM network connections, this might indicate that a malware process is trying to move laterally to other devices in your network. > [!WARNING] > This detection rule is the base for the detection. You will need to add environment specific finetuning in order to limit the BP detections on legitimate processes
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement |
References
Telemetry coverage
Rule body
DeviceNetworkEvents
| where TimeGenerated > ago(1h)
| where RemotePort in ("5985", "5986", "445")
| where ActionType in~ ("ConnectionSuccess", "ConnectionAttempt",
"ConnectionFailed", "ConnectionRequest")
| where isnotempty(InitiatingProcessSHA256)
| invoke FileProfile(InitiatingProcessSHA256)
| where isnotempty(GlobalPrevalence) and GlobalPrevalence < 1000
Stages and Predicates
Stage 1: source
DeviceNetworkEvents
Stage 2: where
| where TimeGenerated > ago(1h)
Stage 3: where
| where RemotePort in ("5985", "5986", "445")
Stage 4: where
| where ActionType in~ ("ConnectionSuccess", "ConnectionAttempt",
"ConnectionFailed", "ConnectionRequest")
Stage 5: where
| where isnotempty(InitiatingProcessSHA256)
Stage 6: invoke
| invoke FileProfile(InitiatingProcessSHA256)
Stage 7: where
| where isnotempty(GlobalPrevalence) and GlobalPrevalence < 1000
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ActionType | in |
| field:"ActionType" kind:in |
GlobalPrevalence | is_not_null | field:"GlobalPrevalence" kind:is_not_null | |
GlobalPrevalence | lt |
| field:"GlobalPrevalence" kind:lt value:"1000" |
InitiatingProcessSHA256 | is_not_null | field:"InitiatingProcessSHA256" kind:is_not_null | |
RemotePort | in |
| field:"DestinationPort" kind:in |