Suspicious Get Information for SMB Share - PowerShell Module (via ps_module)

title: Suspicious Get Information for SMB Share - PowerShell Module (via ps_module)
id: 419dab04-5201-5874-910f-dacaa9b5dc0d
status: stable
description: This rule detects threat actors may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks frequently contain shared network drives and folders that enable users to access file directories on various systems across a network.
references:
    - https://attack.mitre.org/techniques/T1069/001/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md
author: Huntrule Team
date: 2026-05-27
tags:
    - attack.discovery
    - attack.t1069.001
logsource:
    product: windows
    category: ps_module
    definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
    selection:
        - Payload|contains: get-smbshare
        - ContextInfo|contains: get-smbshare
    condition: selection
falsepositives:
    - Unknown
level: low