Detection: Windows File Share Discovery With Powerview

Description

The following analytic identifies the use of the Invoke-ShareFinder PowerShell commandlet part of PowerView. This module obtains the list of all active domain computers and lists the active shares on each computer. Network file shares in Active Directory environments may contain sensitive information like backups, scripts, credentials, etc. Adversaries who have obtained a foothold in an AD network may leverage PowerView to identify secrets and leverage them for Privilege Escalation or Lateral Movement.

Annotations

No annotations available.

Implementation

To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.

Known False Positives

Unknown

Associated Analytic Story

• Active Directory Privilege Escalation

Risk Based Analytics (RBA)

References

• https://github.com/PowerShellEmpire/PowerTools/blob/master/PowerView/powerview.ps1

• https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/

• https://attack.mitre.org/techniques/T1135/

Version: 4