Detection rules › Splunk
Windows Share Multiple File Access (Windows Event Log)
SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain. Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network. This use case looks for share requests to multiple files types within a short period of time
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement |
References
Telemetry coverage
Rule body
id: '6082.6527'
title: Windows Share Multiple File Access
description: 'SMB is a file, printer, and serial port sharing protocol for Windows
machines on the same network or domain. Adversaries may use SMB to interact with
file shares, allowing them to move laterally throughout a network. This use case
looks for share requests to multiple files types within a short period of time.
-- Threat Actor Association: APT29/Nobelium/Cozy Bear, Memento Team, Wizard Spider
-- Software Association: Conti, Lockbit, Ransom Cartel'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5145) OR
"<EventID>5145<")| regex Relative_Target_Name!="(?i)\.(ini|inf)"| regex Relative_Target_Name="(?i)\.\w{2,5}$"
| table _time, host, user process, process_*, signature_id, parent_*, Share_Name,
Relative_Target_Name | bin span=20s | stats values(*) as * by _time, host, Share_Name
| eventstats dc(Relative_Target_Name) as dc_target by host, _time | where dc_target
> 1 AND isnotnull(user) '
techniques:
- lateral-movement:remote services:smb/windows admin shares
technique_id:
- T1021.002
data_category:
- Windows event logs
references:
- https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbclient.py
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=5145) OR "<EventID>5145<")
Stage 2: regex
| regex Relative_Target_Name!="(?i)\.(ini|inf)"
Stage 3: regex
| regex Relative_Target_Name="(?i)\.\w{2,5}$"
Stage 4: table
| table _time, host, user process, process_*, signature_id, parent_*, Share_Name, Relative_Target_Name
Stage 5: bucket
| bin span=20s
Stage 6: stats
| stats values(*) as * by _time, host, Share_Name
Stage 7: eventstats
| eventstats dc(Relative_Target_Name) as dc_target by host, _time
Stage 8: where
| where dc_target > 1 AND isnotnull(user)
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Relative_Target_Name | regex_match | "(?i).(ini|inf)" | excludes:Relative_Target_Name |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"5145" |
Relative_Target_Name | regex_match |
| field:"Relative_Target_Name" kind:regex_match |
dc_target | gt |
| field:"dc_target" kind:gt value:"1" |
user | is_not_null | field:"user" kind:is_not_null |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>5145<" |