PowerShell Module: Get-SmbShare Used for SMB Share Enumeration

Detects PowerShell module usage of Get-SmbShare to enumerate SMB shares across networked systems.

FreeUnreviewedSigmalowv1

powershell-module-get-smbshare-used-for-smb-share-enumeration-6942bd25

title: "PowerShell Module: Get-SmbShare Used for SMB Share Enumeration"
id: 5aef56d5-7a21-4382-86d8-57d5ae7763a7
status: test
description: This rule flags PowerShell module activity where the text contains "get-smbshare" in either the payload or context information. Enumerating SMB shares helps an attacker identify accessible folders and drives for subsequent information collection and potential lateral movement targeting. It relies on Windows PowerShell module telemetry capturing the command/module content in the relevant fields.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_susp_smb_share_reco.yml
author: frack113, Huntrule Team
date: 2021-12-15
modified: 2022-12-02
tags:
  - attack.discovery
  - attack.t1069.001
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection:
    - Payload|contains: get-smbshare
    - ContextInfo|contains: get-smbshare
  condition: selection
falsepositives:
  - Administrator script
level: low
license: DRL-1.1
related:
  - id: 6942bd25-5970-40ab-af49-944247103358
    type: derived

What it detects

This rule flags PowerShell module activity where the text contains "get-smbshare" in either the payload or context information. Enumerating SMB shares helps an attacker identify accessible folders and drives for subsequent information collection and potential lateral movement targeting. It relies on Windows PowerShell module telemetry capturing the command/module content in the relevant fields.

Known false positives

Administrator script

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.