Detection rules › Splunk
Potential Lateral Movement via SMB (Windows Event Log)
Adversaries, typically, start moving laterally once they get initial foothold in the victim organization. Once they get initial access, they escalate their privileges and move laterally with the escalated privileges either to propagate their malware or to further reconnaissance & collect the targeted information. There are many techniques by which threat actors move laterally, this use case focuses solely on detecting potential anomalous SMB Traffic
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 5156: The Windows Filtering Platform has permitted a connection. |
Rule body
id: '9118.12340'
title: Potential Lateral Movement via SMB
description: 'Adversaries, typically, start moving laterally once they get initial
foothold in the victim organization. Once they get initial access, they escalate
their privileges and move laterally with the escalated privileges either to propagate
their malware or to further reconnaissance & collect the targeted information. There
are many techniques by which threat actors move laterally, this use case focuses
solely on detecting potential anomalous SMB Traffic. - Threat Actor Association:
Earth Estries, FIN8 (Syssphinx), Lancefly, Lazarus - Software Association: ALPHV/BlackCat,
Ransom Cartel'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (EventCode=5156 OR "Event>ID>5156<")
(TERM(445) OR TERM(SMB)) | search dest_port="445" src_ip IN(10.0.0.0/8, 127.0.0.0/8,
169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4, 255.255.255.255, "::1",
"FE80::/10", "FF00::/8") dest_ip IN(10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12,
192.168.0.0/16, 224.0.0.0/4, 255.255.255.255, "::1", "FE80::/10", "FF00::/8") |
table _time, host, user dest, direction, event_id, eventtype, parent_*, process,
process_*, user, user_id, src_*, dest_* | bin span=1s | stats values(*) as * by
_time, host | eventstats dc(dest_ip) as dc_dest by src_ip | eventstats dc(src_ip)
as dc_src by dest_ip | eventstats dc(host) as dc_host by process_path| where (dc_dest
< 5 AND dc_src < 5) OR dc_host < 3 OR match(process_path, "(?i)(powershell|cmd)") '
techniques:
- lateral-movement:remote services:smb/windows admin shares
technique_id:
- T1021.002
data_category:
- Windows event logs
- Process use of network
references:
- https://imphash.medium.com/detecting-lateral-movement-101-tracking-movement-smb-windows-admin-shares-through-windows-log-6005e3ba6980
- https://www.ired.team/offensive-security/lateral-movement/lateral-movement-via-smb-relaying-by-abusing-lack-of-smb-signing