Detection rules › Sigma
Suspicious permissions modification on a network share
Detects scenarios where an attacker modifies network share permissions in order to facilitate lateral movement and avoid detection by creating new network shares
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment | T1222.001 File and Directory Permissions Modification: Windows Permissions |
| Lateral Movement | T1021.002 Remote Services: SMB/Windows Admin Shares |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 5143 | A network share object was modified. |
Rule body yaml
title: Suspicious permissions modification on a network share
description: Detects scenarios where an attacker modifies network share permissions in order to facilitate lateral movement and avoid detection by creating new network shares
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1222.001-File%20and%20Directory%20Permissions%20Modification
- https://medium.com/falconforce/falconfriday-monitoring-for-public-shares-0xff1a-ece14fe137e1
tags:
- attack.defense_evasion
- attack.t1222.001
- attack.lateral_movement
- attack.t1021.002
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 5143 # modified share
#OldSD != NewSD # Comparing 2 fields is not possible in SIGMA language
filter:
Computer: '%domain_controllers%'
condition: selection and not filter
falsepositives:
- Administrator modification on network shares, SCCM servers, DFS shares, printer servers
level: medium
Stages and Predicates
Stage 0: condition
selection and not filterStage 1: selection
selection:
EventID: 5143
Stage 2: not filter
filter:
Computer: '%domain_controllers%'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
Computer | eq | %domain_controllers% |