SMB admin share accessed

Status: experimental
Severity: medium
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to connect to the administrative SMB share.

Known false positives

Administrator activity, backup solutions

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1021.002` Remote Services: SMB/Windows Admin Shares

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 5140: A network share object was accessed.
Security-Auditing	Event ID 5145: A network share object was checked to see whether client can be granted desired access.

Rule body

title: SMB admin share accessed
description: Detects scenarios where an attacker attempts to connect to the administrative SMB share.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.002%20-SMB%20Windows%20Admin%20Shares
tags:
- attack.lateral_movement
- attack.t1021.002
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 5140
      - 5145
    ShareName: '\\*\ADMIN$'
  filter: # Filter works only with ID 5145
    - RelativeTargetName|endswith:
      - \cmd.exe        # see remote shell execution via SMB rule
      - \powershell.exe # see remote shell execution via SMB rule
      - \pwsh.exe       # see remote shell execution via SMB rule
    - IpAddress:
      - '%vulnerability_scanners%'
      - '%admin_netork_administration%'
  condition: selection and not filter
falsepositives:
- Administrator activity, backup solutions
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
  EventID:
    - 5140
    - 5145
  ShareName: '\\*\ADMIN$'

Stage 2: `not filter`

filter:
  - RelativeTargetName|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  - IpAddress:
    - '%vulnerability_scanners%'
    - '%admin_netork_administration%'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`IpAddress`	eq	`%admin_netork_administration%`	`excludes:IpAddress` `field:"IpAddress" value:"%admin_netork_administration%"`
`IpAddress`	eq	`%vulnerability_scanners%`	`excludes:IpAddress` `field:"IpAddress" value:"%vulnerability_scanners%"`
`RelativeTargetName`	ends_with	`\cmd.exe`	`excludes:RelativeTargetName` `field:"RelativeTargetName" value:"\cmd.exe"`
`RelativeTargetName`	ends_with	`\powershell.exe`	`excludes:RelativeTargetName` `field:"RelativeTargetName" value:"\powershell.exe"`
`RelativeTargetName`	ends_with	`\pwsh.exe`	`excludes:RelativeTargetName` `field:"RelativeTargetName" value:"\pwsh.exe"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ShareName`	wildcard	`\\*\ADMIN$` corpus 6 (sigma 6)	`field:"ShareName" kind:wildcard value:"\\*\ADMIN$"`

SMB admin share accessed

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Stage 2: not filter

Exclusions

Indicators

Stage 0: `condition`

Stage 1: `selection`

Stage 2: `not filter`