PowerShell Script Block: SMB QUIC Share Mapping via New-SmbMapping

Alerts when PowerShell maps Windows SMB shares using New-SmbMapping with -TransportType QUIC.

FreeReviewedSigma · Medium · v5
Product
windows
Category
ps_script
Author
frack113 (SigmaHQ), DRL 1.1
Published
2023-07-21
Updated
2026-07-31

ATT&CK techniques

Lateral Movement
  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Collection

  11. C2

  12. Exfiltration

  13. Impact

What it detects

This rule flags PowerShell script content that includes New-SmbMapping combined with the -TransportType QUIC parameter, indicating Windows SMB share mapping over QUIC. Unexpected SMB-over-QUIC usage can be leveraged for stealthy lateral movement or unusual remote access patterns. It relies on PowerShell Script Block Logging telemetry capturing the script block text containing both required strings.

Related detections9 linkedT1570 — drag to rearrange
Suspicious Ransomware Fan-Out Deployment via PsExec Spread (Qilin)
Chisel Reverse Tunnel Tool Execution from Temporary Directory
BITS Payload Downloaded via Commandline (via process_creation)
BITS Payload Downloaded via PowerShell (via powershell)
Malicious regsvcs LOLBin Loading Ransomware DLL from UNC Path
Suspicious SMB DLL Lateral Movement
Malicious Remote Process Execution From an SMB Admin Share (via process_creation)
Suspicious Python Execution from WebDAV Share via PowerShell (via process_creation)
Suspicious PsExec Copying Payload To Windows Temp (via process_creation)
PowerShell Script Block: SMB QUIC Share Mapping via New-SmbMapping
Pivot detection · T1570 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.