Suspicious permissions modification on a network share

Status: experimental
Severity: medium
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker modifies network share permissions in order to facilitate lateral movement and avoid detection by creating new network shares

Known false positives

Administrator modification on network shares, SCCM servers, DFS shares, printer servers

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1222.001` File and Directory Permissions Modification: Windows Permissions
Lateral Movement	`T1021.002` Remote Services: SMB/Windows Admin Shares

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 5143: A network share object was modified.

Rule body

title: Suspicious permissions modification on a network share
description: Detects scenarios where an attacker modifies network share permissions in order to facilitate lateral movement and avoid detection by creating new network shares
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1222.001-File%20and%20Directory%20Permissions%20Modification
- https://medium.com/falconforce/falconfriday-monitoring-for-public-shares-0xff1a-ece14fe137e1
tags:
- attack.defense_evasion
- attack.t1222.001
- attack.lateral_movement
- attack.t1021.002
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5143  # modified share
    #OldSD != NewSD # Comparing 2 fields is not possible in SIGMA language
  filter:
    Computer: '%domain_controllers%'
  condition: selection and not filter
falsepositives:
- Administrator modification on network shares, SCCM servers, DFS shares, printer servers
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
  EventID: 5143

Stage 2: `not filter`

filter:
  Computer: '%domain_controllers%'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Computer`	eq	`%domain_controllers%`	`excludes:Computer` `field:"Computer" value:"%domain_controllers%"`