SMB Create Remote File Admin Share

Status: test
Severity: high
Log source: product windows, service security
Author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research)
Source: github.com/SigmaHQ/sigma

Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1021.002` Remote Services: SMB/Windows Admin Shares

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 5145: A network share object was checked to see whether client can be granted desired access.

Rule body

title: SMB Create Remote File Admin Share
id: b210394c-ba12-4f89-9117-44a2464b9511
status: test
description: Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).
references:
    - https://github.com/OTRF/ThreatHunter-Playbook/blob/f7a58156dbfc9b019f17f638b8c62d22e557d350/playbooks/WIN-201012004336.yaml
    - https://securitydatasets.com/notebooks/atomic/windows/lateral_movement/SDWIN-200806015757.html?highlight=create%20file
author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research)
date: 2020-08-06
modified: 2025-10-17
tags:
    - attack.lateral-movement
    - attack.t1021.002
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5145
        ShareName|endswith: 'C$'
        AccessMask: '0x2'
    filter_main_subjectusername:
        SubjectUserName|endswith: '$'
    filter_optional_local_ip:
        IpAddress: '::1'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: `selection`

selection:
    EventID: 5145
    ShareName|endswith: 'C$'
    AccessMask: '0x2'

Stage 2: `not filter_main_subjectusername`

filter_main_subjectusername:
    SubjectUserName|endswith: '$'

Stage 3: `not filter_optional_local_ip`

filter_optional_local_ip:
    IpAddress: '::1'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`SubjectUserName`	ends_with	`$`	`excludes:SubjectUserName` `field:"SubjectUserName" value:"$"`
`IpAddress`	eq	`::1`	`excludes:IpAddress` `field:"IpAddress" value:"::1"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`AccessMask`	eq	`0x2` corpus 2 (sigma 2)	`field:"AccessMask" kind:eq value:"0x2"`
`ShareName`	ends_with	`C$`	`field:"ShareName" kind:ends_with value:"C$"`