Detection rules › Splunk
Windows IPC$ Share Access (Windows Event Log)
Winndows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions. This Use case identifies when network shares C$, ADMIN$, and IPC$ have had an object call. Adversaries may use this technique in conjunction with administrator-level Valid Accounts to remotely access a networked system
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement | T1021.002 Remote Services: SMB/Windows Admin Shares |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 5140 | A network share object was accessed. |
| Security-Auditing | Event ID 5145 | A network share object was checked to see whether client can be granted desired access. |
Rule body yaml
id: '5708.5980'
title: Windows IPC$ Share Access
description: 'Winndows systems have hidden network shares that are accessible only
to administrators and provide the ability for remote file copy and other administrative
functions. This Use case identifies when network shares C$, ADMIN$, and IPC$ have
had an object call. Adversaries may use this technique in conjunction with administrator-level
Valid Accounts to remotely access a networked system. -- Threat Actor Association:
TA428, Volt Typhoon -- Atomics T1021.002 Test#1 Atomics T1021.002 Test#2 Atomics
T1021.002 Test#4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5140) OR
"<EventID>5140<" OR TERM(EventCode=5145) OR "<EventID>5145<") TERM(IPC) | regex
Share_Name="(?i)ipc\$" | eval share_name=Share_Name, share_path=Share_Path, relative_target_name=Relative_Target_Name
| table _time, host, user signature_id, share_*, src_ip, relative_target_name |
bin span=1s | stats values(*) as * by _time, host '
techniques:
- lateral-movement:remote services:smb/windows admin shares
technique_id:
- T1021.002
data_category:
- Windows event logs
references:
- https://support.malwarebytes.com/hc/en-us/articles/360038524714
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5140) OR "<EventID>5140<" OR TERM(EventCode=5145) OR "<EventID>5145<") TERM(IPC)
Stage 2: regex
| regex Share_Name="(?i)ipc\$"
Stage 3: eval
| eval share_name=Share_Name, share_path=Share_Path, relative_target_name=Relative_Target_Name
Stage 4: table
| table _time, host, user signature_id, share_*, src_ip, relative_target_name
Stage 5: bucket
| bin span=1s
Stage 6: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Share_Name | regex_match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>5140<" |
| 1 | TERM |
| 1 | "<EventID>5145<" |
| 1 | TERM |
| 1 | IPC |