huntrule

Windows PowerShell script block containing Get-SmbShare

Alerts on PowerShell script blocks running Get-SmbShare to discover SMB shares.

FreeUnreviewedSigmalowv1
title: Windows PowerShell script block containing Get-SmbShare
id: 43af32be-da09-4c65-92cf-6385e9f01641
status: test
description: This rule flags PowerShell script blocks that include the Get-SmbShare command, indicating discovery of SMB shared folders or shares. Attackers can use this information to identify accessible network resources prior to further collection and lateral movement. The detection relies on Script Block Logging telemetry capturing the script contents and matching on the presence of the command text.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_smb_share_reco.yml
author: frack113, Huntrule Team
date: 2021-12-15
modified: 2022-12-25
tags:
  - attack.discovery
  - attack.t1069.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains: get-smbshare
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 95f0643a-ed40-467c-806b-aac9542ec5ab
    type: derived

What it detects

This rule flags PowerShell script blocks that include the Get-SmbShare command, indicating discovery of SMB shared folders or shares. Attackers can use this information to identify accessible network resources prior to further collection and lateral movement. The detection relies on Script Block Logging telemetry capturing the script contents and matching on the presence of the command text.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.