PowerShell SMB Share Mapping over QUIC (New-SmbMapping)

Alerts when PowerShell maps Windows SMB shares using New-SmbMapping with -TransportType QUIC.

FreeUnreviewedSigmamediumv1

powershell-smb-share-mapping-over-quic-new-smbmapping-6df07c3b

title: PowerShell SMB Share Mapping over QUIC (New-SmbMapping)
id: 9a23f44c-316a-4ca7-876e-57cdd4b4e1a4
related:
  - id: 2238d337-42fb-4971-9a68-63570f2aede4
    type: similar
  - id: 6df07c3b-8456-4f8b-87bb-fe31ec964cae
    type: derived
status: test
description: This rule flags PowerShell script block activity that includes New-SmbMapping with the -TransportType QUIC parameter, indicating SMB access being established over QUIC. Such behavior can be unexpected in many environments and may be used to blend or alter lateral movement patterns compared to more common SMB transports. It relies on Script Block Logging telemetry capturing PowerShell script block contents and matching specific strings within the script text.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1570/T1570.md
  - https://learn.microsoft.com/en-us/powershell/module/smbshare/new-smbmapping?view=windowsserver2022-ps
  - https://www.trustedsec.com/blog/making-smb-accessible-with-ntlmquic/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_new_smbmapping_quic.yml
author: frack113, Huntrule Team
date: 2023-07-21
tags:
  - attack.lateral-movement
  - attack.t1570
  - detection.threat-hunting
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - New-SmbMapping
      - -TransportType QUIC
  condition: selection
falsepositives:
  - Due to the nature of the script block, the matching of the string could sometimes result in a false positive. Use this rule to hunt for potential malicious or suspicious scripts.
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell script block activity that includes New-SmbMapping with the -TransportType QUIC parameter, indicating SMB access being established over QUIC. Such behavior can be unexpected in many environments and may be used to blend or alter lateral movement patterns compared to more common SMB transports. It relies on Script Block Logging telemetry capturing PowerShell script block contents and matching specific strings within the script text.

Known false positives

Due to the nature of the script block, the matching of the string could sometimes result in a false positive. Use this rule to hunt for potential malicious or suspicious scripts.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.