Detection rules › Splunk
Windows IPC$ Share Access (Sysmon)
Winndows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. This Use case identifies when network shares C$, ADMIN$, and IPC$ have had an object call. Adversaries may use this technique in conjunction with administrator-level Valid Accounts to remotely access a networked system
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Sysmon | Event ID 11: FileCreate |
Rule body
id: '5708.11694'
title: Windows IPC$ Share Access
description: 'Winndows systems have hidden network shares that are accessible only
to administrators and provide the ability for remote file copy and other administrative
functions. This Use case identifies when network shares C$, ADMIN$, and IPC$ have
had an object call. Adversaries may use this technique in conjunction with administrator-level
Valid Accounts to remotely access a networked system. -- Threat Actor Association:
TA428, Volt Typhoon -- Atomics T1021.002 Test#1 Atomics T1021.002 Test#2 Atomics
T1021.002 Test#4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "EventID>1<"
OR TERM(EventCode=11) OR "EventID>11<") "ipc$" | table _time, host, user, signature_id,
process, process_*, parent_process_*t `group_events("host", 1)` '
techniques:
- lateral-movement:remote services:smb/windows admin shares
technique_id:
- T1021.002
data_category:
- Windows Sysmon
references:
- https://support.malwarebytes.com/hc/en-us/articles/360038524714
Stages and Predicates
Stage 1: search
search EventCode=1 EventCode=11 source="*" source IN ("WinEventLog:Microsoft-Windows-Sysmon/Operational", "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")
Stage 2: table
table _time, host, parent_process_*t, process, process_*, signature_id, user
Stage 3: bucket
bucket _time
Stage 4: stats
stats BY host, _time
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "EventID>1<" |
| 1 | "EventID>11<" |
| 1 | "ipc$" |