name: Write Executable in SMB Share
id: f63c34fe-a435-11eb-935a-acde48001122
version: 1
date: '2021-04-23'
author: Teoderick Contreras, Splunk
type: batch
datamodel:
- Endpoint
description: This search is to detect suspicious dropping or creating an executable
  file in known sensitive SMB share. This technique is commonly used for lateral movement
  like how trickbot try to infect other machine in the infected network. This detection
  catch the access event (FILE WRITE) access to a share.
search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll")
  Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask=
  "0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode
  Share_Name Relative_Target_Name Object_Type Access_Mask user src_port Source_Address
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `write_executable_in_smb_share_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
  Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also
  required. Also enable the object Audit access success/failure in your group policy.
known_false_positives: unknown
references:
- https://labs.vipre.com/trickbot-and-its-modules/
- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
tags:
  analytic_story:
  - Trickbot
  automated_detection_testing: passed
  confidence: 100
  context:
  - Source:Endpoint
  - Stage:Lateral Movement
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-security.log
  impact: 70
  kill_chain_phases:
  - Lateral Movement
  message: $user$ dropped or created an executable file in known sensitive SMB share.  Share
    name=$Share_Name$, Target name=$Relative_Target_Name$, and Access mask=$Access_Mask$
  mitre_attack_id:
  - T1021.002
  observable:
  - name: user
    type: User
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - EventCode
  - Share_Name
  - Relative_Target_Name
  - Object_Type
  - Access_Mask
  - user
  - src_port
  - Source_Address
  risk_score: 70
  security_domain: endpoint