Detection rules › Splunk
Windows C$ Share Access (Windows Event Log)
Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. This Use case identifies when network shares C$, ADMIN$, and IPC$ have had an object call. Adversaries may use this technique in conjunction with administrator-level Valid Accounts to remotely access a networked system
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement |
References
Telemetry coverage
Rule body
id: '5709.5981'
title: Windows C$ Share Access
description: 'Windows systems have hidden network shares that are accessible only
to administrators and provide the ability for remote file copy and other administrative
functions. This Use case identifies when network shares C$, ADMIN$, and IPC$ have
had an object call. Adversaries may use this technique in conjunction with administrator-level
Valid Accounts to remotely access a networked system. -- Threat Actor Association:
APT29, APT31, Blackmatter, Darkside, FIN8 (Syssphinx), OilRig, Volt Typhoon, Wizard
Spider -- Software Association: Bazar, Black Basta, Clop, Conti, GhostShell, Hafnium,
Qakbot, Ryuk, SamSam, Vice Society -- Atomics T1021.002 Test#1 Atomics T1021.002
Test#2 Atomics T1021.002 Test#4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5140) OR
"<EventID>5140<" OR TERM(EventCode=5145) OR "<EventID>5145<") TERM(C)| regex Share_Name!="(?i)ipc"|
regex Share_Name="(?i)(c)\$" | eval share_name=Share_Name, share_path=Share_Path,
relative_target_name=Relative_Target_Name | table _time, host, user signature_id,
share_*, src_ip, relative_target_name | bin span=1s | stats values(*) as * by _time,
host '
techniques:
- lateral-movement:remote services:smb/windows admin shares
technique_id:
- T1021.002
data_category:
- Windows event logs
references:
- https://support.malwarebytes.com/hc/en-us/articles/360038524714
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5140) OR "<EventID>5140<" OR TERM(EventCode=5145) OR "<EventID>5145<") TERM(C)
Stage 2: regex
| regex Share_Name!="(?i)ipc"
Stage 3: regex
| regex Share_Name="(?i)(c)\$"
Stage 4: eval
| eval share_name=Share_Name, share_path=Share_Path, relative_target_name=Relative_Target_Name
Stage 5: table
| table _time, host, user signature_id, share_*, src_ip, relative_target_name
Stage 6: bucket
| bin span=1s
Stage 7: stats
| stats values(*) as * by _time, host
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Share_Name | regex_match | "(?i)ipc" | excludes:Share_Name |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq |
Share_Name | regex_match |
| field:"Share_Name" kind:regex_match |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>5140<" |
| 1 | "<EventID>5145<" |
| 1 | C |