Detection rules › Splunk
Windows Share Multiple File Access (Windows Event Log)
SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. This use case looks for share requests to multiple files types within a short period of time
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement | T1021.002 Remote Services: SMB/Windows Admin Shares |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 5145 | A network share object was checked to see whether client can be granted desired access. |
Rule body yaml
id: '6082.6527'
title: Windows Share Multiple File Access
description: 'SMB is a file, printer, and serial port sharing protocol for Windows
machines on the same network or domain. Adversaries may use SMB to interact with
file shares, allowing them to move laterally throughout a network. This use case
looks for share requests to multiple files types within a short period of time.
-- Threat Actor Association: APT29/Nobelium/Cozy Bear, Memento Team, Wizard Spider
-- Software Association: Conti, Lockbit, Ransom Cartel'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5145) OR
"<EventID>5145<")| regex Relative_Target_Name!="(?i)\.(ini|inf)"| regex Relative_Target_Name="(?i)\.\w{2,5}$"
| table _time, host, user process, process_*, signature_id, parent_*, Share_Name,
Relative_Target_Name | bin span=20s | stats values(*) as * by _time, host, Share_Name
| eventstats dc(Relative_Target_Name) as dc_target by host, _time | where dc_target
> 1 AND isnotnull(user) '
techniques:
- lateral-movement:remote services:smb/windows admin shares
technique_id:
- T1021.002
data_category:
- Windows event logs
references:
- https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbclient.py
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5145) OR "<EventID>5145<")
Stage 2: regex
| regex Relative_Target_Name!="(?i)\.(ini|inf)"
Stage 3: regex
| regex Relative_Target_Name="(?i)\.\w{2,5}$"
Stage 4: table
| table _time, host, user process, process_*, signature_id, parent_*, Share_Name, Relative_Target_Name
Stage 5: bucket
| bin span=20s
Stage 6: stats
| stats values(*) as * by _time, host, Share_Name
Stage 7: eventstats
| eventstats dc(Relative_Target_Name) as dc_target by host, _time
Stage 8: where
| where dc_target > 1 AND isnotnull(user)
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
Relative_Target_Name | regex_match | "(?i).(ini|inf)" |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Relative_Target_Name | regex_match |
|
dc_target | gt |
|
user | is_not_null |
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>5145<" |