detection.wiki

Detection rules › Sigma

SMB admin share accessed

Status
experimental
Severity
medium
Log source
product windows, service security
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to connect to the administrative SMB share.

MITRE ATT&CK coverage

TacticTechniques
Lateral MovementT1021.002 Remote Services: SMB/Windows Admin Shares

Event coverage

ProviderEventTitle
Security-AuditingEvent ID 5140A network share object was accessed.
Security-AuditingEvent ID 5145A network share object was checked to see whether client can be granted desired access.

Rule body yaml

title: SMB admin share accessed
description: Detects scenarios where an attacker attempts to connect to the administrative SMB share.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.002%20-SMB%20Windows%20Admin%20Shares
tags:
- attack.lateral_movement
- attack.t1021.002
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 5140
      - 5145
    ShareName: '\\*\ADMIN$'
  filter: # Filter works only with ID 5145
    - RelativeTargetName|endswith:
      - \cmd.exe        # see remote shell execution via SMB rule
      - \powershell.exe # see remote shell execution via SMB rule
      - \pwsh.exe       # see remote shell execution via SMB rule
    - IpAddress:
      - '%vulnerability_scanners%'
      - '%admin_netork_administration%'
  condition: selection and not filter
falsepositives:
- Administrator activity, backup solutions
level: medium

Stages and Predicates

Stage 0: condition

selection and not filter

Stage 1: selection

selection:
  EventID:
    - 5140
    - 5145
  ShareName: '\\*\ADMIN$'

Stage 2: not filter

filter:
  - RelativeTargetName|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  - IpAddress:
    - '%vulnerability_scanners%'
    - '%admin_netork_administration%'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
IpAddresseq%admin_netork_administration%
IpAddresseq%vulnerability_scanners%
RelativeTargetNameends_with\cmd.exe
RelativeTargetNameends_with\powershell.exe
RelativeTargetNameends_with\pwsh.exe

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ShareNamewildcard
  • \\*\ADMIN$ corpus 6 (sigma 6)