
title: SMB Create Remote File Admin Share
author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research)
date: 2020/08/06
description: Look for non-system accounts SMB accessing a file with write (0x2) access
  mask via administrative share (i.e C$).
detection:
  SELECTION_1:
    EventID: 5145
  SELECTION_2:
    ShareName: '*C$'
  SELECTION_3:
    AccessMask: '0x2'
  SELECTION_4:
    SubjectUserName: '*$'
  condition: ((SELECTION_1 and SELECTION_2 and SELECTION_3) and  not (SELECTION_4))
falsepositives:
- Unknown
id: b210394c-ba12-4f89-9117-44a2464b9511
level: high
logsource:
  product: windows
  service: security
references:
- https://github.com/OTRF/ThreatHunter-Playbook/blob/master/playbooks/WIN-201012004336.yaml
- https://securitydatasets.com/notebooks/small/windows/08_lateral_movement/SDWIN-200806015757.html?highlight=create%20file
status: experimental
tags:
- attack.lateral_movement
- attack.t1021.002
ruletype: SIGMA
