Detection: Windows Network Share Interaction With Net

Description

This analytic detects network share discovery and collection activities performed on Windows systems using the Net command. Attackers often use network share discovery to identify accessible shared resources within a network, which can be a precursor to privilege escalation or data exfiltration. By monitoring Windows Event Logs for the usage of the Net command to list and interact with network shares, this detection helps identify potential reconnaissance and collection activities.

Search

1
2| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.user_category) as user_category values(Processes.user_bunit) as user_bunit  FROM datamodel=Endpoint.Processes WHERE (Processes.process_name="net.exe" OR Processes.process_name="net1.exe" OR Processes.orig_process_name="net.exe" OR Processes.orig_process_name="net1.exe") BY Processes.user Processes.dest Processes.process_exec Processes.parent_process_exec Processes.process Processes.parent_process 
3| `drop_dm_object_name(Processes)` 
4| regex process="net[\s\.ex1]+view
5|net[\s\.ex1]+share
6|net[\s\.ex1]+use\s" 
7| `security_content_ctime(firstTime)` 
8| `security_content_ctime(lastTime)` 
9| `windows_network_share_interaction_with_net_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 1	Windows	'xmlwineventlog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

The detection is based on data originating from either Endpoint Detection and Response (EDR) telemetry or EventCode 4688 with process command line logging enabled. These sources provide security-related telemetry from the endpoints. To implement this search, you must ingest logs that contain the process name, parent process, and complete command-line executions. These logs must be mapped to the Splunk Common Information Model (CIM) to normalize the field names capture the data within the datamodel schema.

Known False Positives

Unknown

Associated Analytic Story

• Active Directory Discovery

• Active Directory Privilege Escalation

• Network Discovery

Risk Based Analytics (RBA)

References

• https://attack.mitre.org/techniques/T1135/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 2