Suspicious Get Information for SMB Share (via ps_script)

title: Suspicious Get Information for SMB Share (via ps_script)
id: c79a3062-3a3d-5eb8-b2c4-a979d61556f2
status: stable
description: This rule detects threat actors may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks frequently contain shared network drives and folders that enable users to access file directories on various systems across a network.
references:
    - https://attack.mitre.org/techniques/T1069/001/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md
author: Huntrule Team
date: 2026-02-16
tags:
    - attack.discovery
    - attack.t1069.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains: get-smbshare
    condition: selection
falsepositives:
    - Unknown
level: low