PowerShell Script Block: SMB QUIC Share Mapping via New-SmbMapping
Alerts when PowerShell maps Windows SMB shares using New-SmbMapping with -TransportType QUIC.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2023-07-21
- Updated
- 2026-07-31
ATT&CK techniques
Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script content that includes New-SmbMapping combined with the -TransportType QUIC parameter, indicating Windows SMB share mapping over QUIC. Unexpected SMB-over-QUIC usage can be leveraged for stealthy lateral movement or unusual remote access patterns. It relies on PowerShell Script Block Logging telemetry capturing the script block text containing both required strings.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1570/T1570.md
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/smbshare/new-smbmapping?view=windowsserver2022-ps
- trustedsec.comhttps://www.trustedsec.com/blog/making-smb-accessible-with-ntlmquic/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_new_smbmapping_quic.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "PowerShell Script Block: SMB QUIC Share Mapping via New-SmbMapping"
id: 9a23f44c-316a-4ca7-876e-57cdd4b4e1a4
related:
- id: 2238d337-42fb-4971-9a68-63570f2aede4
type: similar
- id: 6df07c3b-8456-4f8b-87bb-fe31ec964cae
type: derived
status: test
description: This rule flags PowerShell script content that includes New-SmbMapping combined with the -TransportType QUIC parameter, indicating Windows SMB share mapping over QUIC. Unexpected SMB-over-QUIC usage can be leveraged for stealthy lateral movement or unusual remote access patterns. It relies on PowerShell Script Block Logging telemetry capturing the script block text containing both required strings.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1570/T1570.md
- https://learn.microsoft.com/en-us/powershell/module/smbshare/new-smbmapping?view=windowsserver2022-ps
- https://www.trustedsec.com/blog/making-smb-accessible-with-ntlmquic/
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_new_smbmapping_quic.yml
author: frack113, Huntrule Team
date: 2023-07-21
tags:
- attack.lateral-movement
- attack.t1570
- detection.threat-hunting
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains|all:
- New-SmbMapping
- -TransportType QUIC
condition: selection
falsepositives:
- Due to the nature of the script block, the matching of the string could sometimes result in a false positive. Use this rule to hunt for potential malicious or suspicious scripts.
level: medium
license: DRL-1.1