Rules Contributing to Sensitive Windows Network Share File or Folder Accessed Alerts

The following rules are used to identify suspicious activity with Windows network share file or folder access. Any one or more of these will trigger Sensitive Windows Network Share File or Folder Accessed Alert. Details for each rule can be viewed by clicking the More Details link in the description.

Title

Description

Impacket PsExec Execution

Detects execution of Impacket's psexec.py.

Rule ID

windows_security_150

Query

{'selection1': {'EventID': 5145, 'ShareName': '\\\\*\\IPC$', 'RelativeTargetName|contains': ['RemCom_stdin', 'RemCom_stdout', 'RemCom_stderr']}, 'condition': 'selection1'}

Log Source

Stellar Cyber Windows Server Sensor configured for:

  • Collecting Windows security events

  • The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure

Rule Source

SigmaHQ,32d56ea1-417f-44ff-822b-882873f5f43b

Author: Bhabesh Raj

Tactics, Techniques, and Procedures

T1021.002

References

N/A

Severity

75

Suppression Logic Based On

  • event_id
  • computer_name
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
test 2020/12/14 high

  • Unknown

Remote Task Creation via ATSVC Named Pipe

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Rule ID

windows_security_151

Query

{'selection': {'EventID': 5145, 'ShareName': '\\\\*\\IPC$', 'RelativeTargetName': 'atsvc', 'Accesses|contains': ['WriteData', '%%4417']}, 'condition': 'selection'}

Log Source

Stellar Cyber Windows Server Sensor configured for:

  • Collecting Windows security events

  • The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure

Rule Source

SigmaHQ,f6de6525-4509-495a-8a82-1f8b0ed73a00

Author: Samir Bousseaden

Tactics, Techniques, and Procedures

T1053.002

References

N/A

Severity

50

Suppression Logic Based On

  • event_id
  • computer_name
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
test 2019/04/03 medium

  • Unknown

Protected Storage Service Access

Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers

Rule ID

windows_security_152

Query

{'selection': {'EventID': 5145, 'ShareName|contains': 'IPC', 'RelativeTargetName': 'protected_storage'}, 'condition': 'selection'}

Log Source

Stellar Cyber Windows Server Sensor configured for:

  • Collecting Windows security events

Rule Source

SigmaHQ,45545954-4016-43c6-855e-eae8f1c369dc

Author: Roberto Rodriguez @Cyb3rWard0g

Tactics, Techniques, and Procedures

T1021.002

References

Severity

75

Suppression Logic Based On

  • event_id
  • computer_name
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
test 2019/08/10 high

  • Unknown

Persistence and Execution at Scale via GPO Scheduled Task

Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale

Rule ID

windows_security_153

Query

{'selection': {'EventID': 5145, 'ShareName': '\\\\*\\SYSVOL', 'RelativeTargetName|endswith': 'ScheduledTasks.xml', 'Accesses|contains': ['WriteData', '%%4417']}, 'condition': 'selection'}

Log Source

Stellar Cyber Windows Server Sensor configured for:

  • Collecting Windows security events

  • The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure

Rule Source

SigmaHQ,a8f29a7b-b137-4446-80a0-b804272f3da2

Author: Samir Bousseaden

Tactics, Techniques, and Procedures

T1053.005

References

Severity

75

Suppression Logic Based On

  • event_id
  • computer_name
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
test 2019/04/03 high

  • If the source IP is not localhost then it's super suspicious, better to monitor both local and remote changes to GPO scheduledtasks

First Time Seen Remote Named Pipe

This detection excludes known named pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

Rule ID

windows_security_154

Query

{'selection1': {'EventID': 5145, 'ShareName': '\\\\*\\IPC$'}, 'false_positives': {'RelativeTargetName': ['atsvc', 'samr', 'lsarpc', 'lsass', 'winreg', 'netlogon', 'srvsvc', 'protected_storage', 'wkssvc', 'browser', 'netdfs', 'svcctl', 'spoolss', 'ntsvcs', 'LSM_API_service', 'HydraLsPipe', 'TermSrv_API_service', 'MsFteWds', 'sql\\query', 'eventlog']}, 'condition': 'selection1 and not false_positives'}

Log Source

Stellar Cyber Windows Server Sensor configured for:

  • Collecting Windows security events

  • The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure

Rule Source

SigmaHQ,52d8b0c6-53d6-439a-9e41-52ad442ad9ad

Author: Samir Bousseaden

Tactics, Techniques, and Procedures

T1021.002

References

Severity

75

Suppression Logic Based On

  • event_id
  • computer_name
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
test 2019/04/03 high

  • Update the excluded named pipe to filter out any newly observed legit named pipe

DCERPC SMB Spoolss Named Pipe

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

Rule ID

windows_security_155

Query

{'selection': {'EventID': 5145, 'ShareName': '\\\\*\\IPC$', 'RelativeTargetName': 'spoolss'}, 'condition': 'selection'}

Log Source

Stellar Cyber Windows Server Sensor configured for:

  • Collecting Windows security events

Rule Source

SigmaHQ,214e8f95-100a-4e04-bb31-ef6cba8ce07e

Author: OTR (Open Threat Research)

Tactics, Techniques, and Procedures

T1021.002

References

Severity

50

Suppression Logic Based On

  • event_id
  • computer_name
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
test 2018/11/28 medium

  • Domain Controllers acting as printer servers too? :)

T1047 Wmiprvse Wbemcomn DLL Hijack

Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario.

Rule ID

windows_security_157

Query

{'selection': {'EventID': 5145, 'RelativeTargetName|endswith': '\\wbem\\wbemcomn.dll'}, 'filter': {'SubjectUserName|endswith': '$'}, 'condition': 'selection and not filter'}

Log Source

Stellar Cyber Windows Server Sensor configured for:

  • Collecting Windows security events

Rule Source

SigmaHQ,f6c68d5f-e101-4b86-8c84-7d96851fd65c

Author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR)

Tactics, Techniques, and Procedures

T1021.002, T1047

References

Severity

75

Suppression Logic Based On

  • event_id
  • computer_name
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
test 2020/10/12 high

  • Unknown

CVE-2021-1675 Print Spooler Exploitation IPC Access

Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527

Rule ID

windows_security_159

Query

{'selection': {'EventID': 5145, 'ShareName': '\\\\*\\IPC$', 'RelativeTargetName': 'spoolss', 'AccessMask': '0x3', 'ObjectType': 'File'}, 'condition': 'selection'}

Log Source

Stellar Cyber Windows Server Sensor configured for:

  • Collecting Windows security events

Rule Source

SigmaHQ,8fe1c584-ee61-444b-be21-e9054b229694

Author: INIT_6

Tactics, Techniques, and Procedures

T1569

References

Severity

90

Suppression Logic Based On

  • event_id
  • computer_name
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
experimental 2021/07/02 critical

  • Unknown

Possible PetitPotam Coerce Authentication Attempt

Detect PetitPotam coerced authentication activity.

Rule ID

windows_security_161

Query

{'selection': {'EventID': 5145, 'ShareName|startswith': '\\\\', 'ShareName|endswith': '\\IPC$', 'RelativeTargetName': 'lsarpc', 'SubjectUserName': 'ANONYMOUS LOGON'}, 'condition': 'selection'}

Log Source

Stellar Cyber Windows Server Sensor configured for:

  • Collecting Windows security events

  • The advanced audit policy setting "Object Access > Detailed File Share" must be configured for Success/Failure

Rule Source

SigmaHQ,1ce8c8a3-2723-48ed-8246-906ac91061a6

Author: Mauricio Velazco, Michael Haag

Tactics, Techniques, and Procedures

T1187

References

Severity

75

Suppression Logic Based On

  • event_id
  • computer_name
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
experimental 2021/09/02 high

  • Unknown. Feedback welcomed.

Possible Impacket SecretDump Remote Activity

Detect AD credential dumping using impacket secretdump HKTL

Rule ID

windows_security_162

Query

{'selection': {'EventID': 5145, 'ShareName': '\\\\*\\ADMIN$', 'RelativeTargetName|contains|all': ['SYSTEM32\\', '.tmp']}, 'condition': 'selection'}

Log Source

Stellar Cyber Windows Server Sensor configured for:

  • Collecting Windows security events

  • The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure

Rule Source

SigmaHQ,252902e3-5830-4cf6-bf21-c22083dfd5cf

Author: Samir Bousseaden, wagga

Tactics, Techniques, and Procedures

T1003

References

N/A

Severity

75

Suppression Logic Based On

  • event_id
  • computer_name
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
experimental 2019/04/03 high

  • Unknown

Suspicious PsExec Execution

detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one

Rule ID

windows_security_164

Query

{'selection1': {'EventID': 5145, 'ShareName': '\\\\*\\IPC$', 'RelativeTargetName|endswith': ['-stdin', '-stdout', '-stderr']}, 'filter': {'RelativeTargetName|startswith': 'PSEXESVC'}, 'condition': 'selection1 and not filter'}

Log Source

Stellar Cyber Windows Server Sensor configured for:

  • Collecting Windows security events

  • The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure

Rule Source

SigmaHQ,c462f537-a1e3-41a6-b5fc-b2c2cef9bf82

Author: Samir Bousseaden

Tactics, Techniques, and Procedures

T1021.002

References

N/A

Severity

75

Suppression Logic Based On

  • event_id
  • computer_name
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
test 2019/04/03 high

  • Unknown

DCOM InternetExplorer.Application Iertutil DLL Hijack - Security

Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.

Rule ID

windows_security_165

Query

{'selection': {'EventID': 5145, 'RelativeTargetName|endswith': '\\Internet Explorer\\iertutil.dll'}, 'filter': {'SubjectUserName|endswith': '$'}, 'condition': 'selection and not filter'}

Log Source

Stellar Cyber Windows Server Sensor configured for:

  • Collecting Windows security events

Rule Source

SigmaHQ,c39f0c81-7348-4965-ab27-2fde35a1b641

Author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR)

Tactics, Techniques, and Procedures

T1021

References

Severity

75

Suppression Logic Based On

  • event_id
  • computer_name
  • stellar.rule_id

Additional Information

Maturity Creation Date Risk Level False Positives
test 2020/10/12 high

  • Unknown