discovery_net_share_discovery_winlog.toml

[metadata]
creation_date = "2023/07/14"
integration = ["windows", "system"]
maturity = "production"
updated_date = "2024/10/28"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."

[rule]
author = ["Elastic"]
building_block_type = "default"
description = """
Adversaries may look for folders and drives shared on remote systems to identify sources of information to gather as a
precursor for collection and identify potential systems of interest for Lateral Movement.
"""
from = "now-119m"
index = ["winlogbeat-*", "logs-windows.*", "logs-system.security*"]
interval = "60m"
language = "eql"
license = "Elastic License v2"
name = "Potential Network Share Discovery"
risk_score = 21
rule_id = "b2318c71-5959-469a-a3ce-3a0768e63b9c"
severity = "low"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Discovery",
    "Tactic: Collection",
    "Rule Type: BBR",
    "Data Source: System",
]
type = "eql"

query = '''
sequence by user.name, source.port, source.ip with maxspan=15s 
 [file where event.action == "network-share-object-access-checked" and 
  winlog.event_data.ShareName in ("\\\\*\\ADMIN$", "\\\\*\\C$") and 
  source.ip != null and source.ip != "0.0.0.0" and source.ip != "::1" and source.ip != "::" and source.ip != "127.0.0.1"]
 [file where event.action == "network-share-object-access-checked" and 
  winlog.event_data.ShareName in ("\\\\*\\ADMIN$", "\\\\*\\C$") and 
  source.ip != null and source.ip != "0.0.0.0" and source.ip != "::1" and source.ip != "::" and source.ip != "127.0.0.1"]
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1135"
name = "Network Share Discovery"
reference = "https://attack.mitre.org/techniques/T1135/"


[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1039"
name = "Data from Network Shared Drive"
reference = "https://attack.mitre.org/techniques/T1039/"


[rule.threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"