Windows IPC$ Share Access (Windows Event Log)

id: '5708.5980'
title: Windows IPC$ Share Access
description: 'Winndows systems have hidden network shares that are accessible only
  to administrators and provide the ability for remote file copy and other administrative
  functions. This Use case identifies when network shares C$, ADMIN$, and IPC$ have
  had an object call. Adversaries may use this technique in conjunction with administrator-level
  Valid Accounts to remotely access a networked system. -- Threat Actor Association:
  TA428, Volt Typhoon -- Atomics T1021.002 Test#1 Atomics T1021.002 Test#2 Atomics
  T1021.002 Test#4'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5140) OR
  "<EventID>5140<" OR TERM(EventCode=5145) OR "<EventID>5145<") TERM(IPC) | regex
  Share_Name="(?i)ipc\$" | eval share_name=Share_Name, share_path=Share_Path, relative_target_name=Relative_Target_Name
  | table _time, host, user signature_id, share_*, src_ip, relative_target_name |
  bin span=1s | stats values(*) as * by _time, host '
techniques:
- lateral-movement:remote services:smb/windows admin shares
technique_id:
- T1021.002
data_category:
- Windows event logs
references:
- https://support.malwarebytes.com/hc/en-us/articles/360038524714