PowerHuntShares Commands (Sysmon)

id: '31298.56022'
title: PowerHuntShares Commands
description: Adversaries may look for folders and drives shared on remote systems
  as a means of identifying sources of information to gather as a precursor for Collection
  and to identify potential systems of interest for Lateral Movement. Networks often
  contain shared network drives and folders that enable users to access file directories
  on various systems across a network. Adversaries may attempt to get a listing of
  valid accounts, usernames, or email addresses on a system or within a compromised
  environment. This information can help adversaries determine which accounts exist,
  which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks,
  or account takeovers (e.g., Valid Accounts). Adversaries may attempt to get a listing
  of other systems by IP address, hostname, or other logical identifier on a network
  that may be used for Lateral Movement from the current system. This use case detects
  PowerHuntShares' commands used for network share/account/remote system discovery.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(Invoke-HuntSMBShares) OR TERM(Get-CardCreationTime) OR TERM(Get-CardLastAccess)
  OR TERM(Get-CardLastModified) OR TERM(Get-PercentDisplay) OR TERM(Get-ExPrivSumData)
  OR TERM(Get-GroupOwnerBar) OR TERM(Get-GroupNameBar) OR TERM(Get-GroupFileBar) OR
  TERM(Get-UserAceCounts) OR TERM(Convert-DataTableToHtmlTable) OR TERM(Convert-DataTableToHtmlReport)
  OR TERM(Get-FolderGroupMd5) OR TERM(Get-LdapQuery) OR TERM(Get-DomainSubnet) OR
  TERM(Invoke-Parallel) OR TERM(checkSubnet)) | table _time, host, user, process,
  parent_process, process_name | bin span=1s | stats values(*) as * by _time, host '
techniques:
- discovery:network share discovery
- discovery:account discovery
- discovery:remote system discovery
technique_id: 
- T1135
- T1087
- T1018
data_category:
- Windows Sysmon
references:
- https://attack.mitre.org/techniques/T1135/
- https://attack.mitre.org/techniques/T1087/
- https://attack.mitre.org/techniques/T1018/
- https://github.com/NetSPI/PowerHuntShares/tree/main
- https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations/