Query: detection rule: Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).
Matching passage: Sigma rule: Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).. Logsource: windows / security. Rule: title: SMB Create Remote File Admin Share id: b210394c-ba12-4f89-9117-44a2464b9511 status: test description: Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$). references: - https://github.com/OTRF/ThreatHunter-Playbook/blob/f7a58156dbfc9b019f17f638b8c62d22e557d350/playbooks/WIN-201012004336.yaml - https://securitydatasets.com/notebooks/atomic/windows/lateral_movement/SDWIN-200806015757.html?highlight=create%20file author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research) date: 2020-08-06 modified: 2025-10-17 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security detection: selection: EventID: 5145 ShareName|endswith: C$ AccessMask: '0x2' filter_main_subjectusername: SubjectUserName|endswith: $ filter_optional_local_ip: IpAddress: ::1 condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects AdFind execution with common flags seen used during attacks. Logsource: windows / process_creation. Rule: title: PUA - AdFind Suspicious Execution id: 9a132afa-654e-11eb-ae93-0242ac130002 related: - id: 455b9d50-15a1-4b99-853f-8d37655a4c1b type: similar - id: 75df3b17-8bcc-4565-b89b-c9898acef911 type: obsolete status: test description: Detects AdFind execution with common flags seen used during attacks references: - https://www.joeware.net/freetools/tools/adfind/ - https://thedfirreport.com/2020/05/08/adfind-recon/ - https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/ - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ - https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx - https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1087.002/T1087.002.md#atomic-test-7---adfind---enumerate-active-directory-user-objects author: Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community date: 2021-02-02 modified: 2025-10-24 tags: - attack.discovery - attack.t1018 - attack.t1087.002 - attack.t1482 - attack.t1069.002 - stp.1u logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - domainlist - trustdmp - dcmodes - adinfo - -sc dclist - computer_pwdnotreqd - objectcategory= - -subnets -f - name="Domain Admins" - '-sc u:' - domainncs - dompol - ' oudmp ' - subnetdmp - gpodmp - fspdmp - users_noexpire - computers_active - computers_pwdnotreqd condition: selection falsepositives: - Legitimate admin activity level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage/info.yml simulation: - type: atomic-red-team name: Adfind - Enumerate Active Directory Computer Objects technique: T1018 atomic_guid: a889f5be-2d54-4050-bd05-884578748bb4 - type: atomic-red-team name: Adfind - Enumerate Active Directory Domain Controller Objects technique: T1018 atomic_guid: 5838c31e-a0e2-4b9f-b60a-d79d2cb7995e