SigmaHQ/rules/windows/builtin/win_smb_file_creation_admin_shares.yml

title: SMB Create Remote File Admin Share
id: b210394c-ba12-4f89-9117-44a2464b9511
description: Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).
status: experimental
date: 2020/08/06
author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research)
tags:
    - attack.lateral_movement
    - attack.t1021.002
references:
    - https://github.com/OTRF/ThreatHunter-Playbook/blob/master/playbooks/WIN-201012004336.yaml
    - https://mordordatasets.com/notebooks/small/windows/08_lateral_movement/SDWIN-200806015757.html?highlight=create%20file
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5145
        ShareName|endswith: 'C$'
        AccessMask: '0x2'
    filter:
        SubjectUserName|endswith: '$'
    condition: selection and not filter
falsepositives:
    - Unknown
level: high