Potential Lateral Movement via SMB (Sysmon)

Source: github.com/anvilogic-forge/armory

Adversaries, typically, start moving laterally once they get initial foothold in the victim organization. Once they get initial access, they escalate their privileges and move laterally with the escalated privileges either to propagate their malware or to further reconnaissance & collect the targeted information. There are many techniques by which threat actors move laterally, this use case focuses solely on detecting potential anomalous SMB Traffic

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1021.002` Remote Services: SMB/Windows Admin Shares

References

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 3: Network connection

Rule body

id: '9118.12339'
title: Potential Lateral Movement via SMB
description: 'Adversaries, typically, start moving laterally once they get initial
  foothold in the victim organization. Once they get initial access, they escalate
  their privileges and move laterally with the escalated privileges either to propagate
  their malware or to further reconnaissance & collect the targeted information. There
  are many techniques by which threat actors move laterally, this use case focuses
  solely on detecting potential anomalous SMB Traffic. - Threat Actor Association:
  Earth Estries, FIN8 (Syssphinx), Lancefly, Lazarus - Software Association: ALPHV/BlackCat,
  Ransom Cartel'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (EventCode=3 OR "Event>ID>3<")
  (TERM(445) OR TERM(SMB)) | search dest_port="445" src_ip IN(10.0.0.0/8, 127.0.0.0/8,
  169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4, 255.255.255.255, "::1",
  "FE80::/10", "FF00::/8") dest_ip IN(10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12,
  192.168.0.0/16, 224.0.0.0/4, 255.255.255.255, "::1", "FE80::/10", "FF00::/8") |
  table _time, host, user dest, direction, event_id, eventtype, parent_*, process,
  process_*, user, user_id, src_*, dest_* | bin span=1s | stats values(*) as * by
  _time, host | eventstats dc(dest_ip) as dc_dest by src_ip | eventstats dc(src_ip)
  as dc_src by dest_ip | eventstats dc(host) as dc_host by process_path| where (dc_dest
  < 5 AND dc_src < 5) OR dc_host < 3 OR match(process_path, "(?i)(powershell|cmd)") '
techniques:
- lateral-movement:remote services:smb/windows admin shares
technique_id:
- T1021.002
data_category:
- Windows Sysmon
- Process use of network
references:
- https://imphash.medium.com/detecting-lateral-movement-101-tracking-movement-smb-windows-admin-shares-through-windows-log-6005e3ba6980
- https://www.ired.team/offensive-security/lateral-movement/lateral-movement-via-smb-relaying-by-abusing-lack-of-smb-signing