splunk-security_content/detections/endpoint/powershell_enable_smb1protocol_feature.yml

name: Powershell Enable SMB1Protocol Feature
id: afed80b2-d34b-11eb-a952-acde48001122
version: 3
date: '2024-05-13'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects the enabling of the SMB1 protocol via
  `powershell.exe`. It leverages PowerShell script block logging (EventCode 4104)
  to identify the execution of the `Enable-WindowsOptionalFeature` cmdlet with the
  `SMB1Protocol` parameter. This activity is significant because enabling SMB1 can
  facilitate lateral movement and file encryption by ransomware, such as RedDot. If
  confirmed malicious, this action could allow an attacker to propagate through the
  network, encrypt files, and potentially disrupt business operations.
data_source:
- Powershell Script Block Logging 4104
search: '`powershell` EventCode=4104 ScriptBlockText = "*Enable-WindowsOptionalFeature*"
  ScriptBlockText = "*SMB1Protocol*" | stats count min(_time) as firstTime max(_time)
  as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `powershell_enable_smb1protocol_feature_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the powershell logs  from your endpoints. make sure you enable needed
  registry to monitor this event.
known_false_positives: network operator may enable or disable this windows feature.
references:
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
tags:
  analytic_story:
  - Ransomware
  - Malicious PowerShell
  - Hermetic Wiper
  - Data Destruction
  asset_type: Endpoint
  confidence: 50
  impact: 50
  message: Powershell Enable SMB1Protocol Feature on $Computer$
  mitre_attack_id:
  - T1027
  - T1027.005
  observable:
  - name: Computer
    type: Hostname
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - EventCode
  - ScriptBlockText
  - Computer
  - UserID
  risk_score: 25
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: 
      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
    sourcetype: xmlwineventlog