macOS Network Share Access

Status: experimental
Severity: medium
Log source: product macos, service endpointsecurity
Author: Eric Brown - Nebulock, Inc.
Source: github.com/Nebulock-Inc/macos-coresigma

Detects mounting of network shares (SMB, AFP, NFS) which may indicate lateral movement attempts or access to shared resources on other systems. Adversaries may mount network shares to access files or move laterally.

Known false positives

Legitimate network share access for file sharing
Automated backup systems accessing network storage
Enterprise applications using network file systems

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1021.002` Remote Services: SMB/Windows Admin Shares
Collection	`T1039` Data from Network Shared Drive

Rule body

title: macOS Network Share Access
id: 7e7b928d-44fa-405e-a33d-29e6b09628f0
status: experimental
description: 'Detects mounting of network shares (SMB, AFP, NFS) which may indicate
  lateral

  movement attempts or access to shared resources on other systems. Adversaries

  may mount network shares to access files or move laterally.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1021/002/
- https://attack.mitre.org/techniques/T1039/
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection_event:
    esf.event_type: 9
    event.action: exec
  selection_process:
    Image|endswith:
    - /mount
    - /mount_smbfs
    - /mount_afp
    - /mount_nfs
  condition: selection_event and selection_process
falsepositives:
- Legitimate network share access for file sharing
- Automated backup systems accessing network storage
- Enterprise applications using network file systems
fields:
- Image
- CommandLine
- ProcessId
- ParentProcessId
- User
tags:
- attack.lateral_movement
- attack.t1021.002
- attack.t1039
level: medium

Stages and Predicates

Stage 0: `condition`

selection_event and selection_process

Stage 1: `selection_event`

selection_event:
  esf.event_type: 9
  event.action: exec

Stage 2: `selection_process`

selection_process:
  Image|endswith:
  - /mount
  - /mount_smbfs
  - /mount_afp
  - /mount_nfs

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`/mount` `/mount_afp` `/mount_nfs` `/mount_smbfs`	`field:"Image" kind:ends_with`
`esf.event_type`	eq	`9`	`field:"esf.event_type" kind:eq value:"9"`
`event.action`	eq	`exec`	`field:"EventType" kind:eq value:"exec"`