Mounting Hidden or WebDav Remote Shares

  1[metadata]
  2creation_date = "2020/11/02"
  3integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2024/11/02"
  6min_stack_version = "8.14.0"
  7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Identifies the use of net.exe to mount a WebDav or hidden remote share. This may indicate lateral movement or
 13preparation for data exfiltration.
 14"""
 15from = "now-9m"
 16index = [
 17    "logs-endpoint.events.process-*",
 18    "winlogbeat-*",
 19    "logs-windows.forwarded*",
 20    "logs-windows.sysmon_operational-*",
 21    "endgame-*",
 22    "logs-system.security*",
 23    "logs-m365_defender.event-*",
 24    "logs-sentinel_one_cloud_funnel.*",
 25    "logs-crowdstrike.fdr*",
 26]
 27language = "eql"
 28license = "Elastic License v2"
 29name = "Mounting Hidden or WebDav Remote Shares"
 30risk_score = 47
 31rule_id = "c4210e1c-64f2-4f48-b67e-b5a8ffe3aa14"
 32severity = "medium"
 33tags = [
 34    "Domain: Endpoint",
 35    "OS: Windows",
 36    "Use Case: Threat Detection",
 37    "Tactic: Initial Access",
 38    "Tactic: Lateral Movement",
 39    "Data Source: Elastic Endgame",
 40    "Data Source: Elastic Defend",
 41    "Data Source: System",
 42    "Data Source: Microsoft Defender for Endpoint",
 43    "Data Source: Sysmon",
 44    "Data Source: SentinelOne",
 45    "Data Source: Crowdstrike",
 46]
 47timestamp_override = "event.ingested"
 48type = "eql"
 49
 50query = '''
 51process where host.os.type == "windows" and event.type == "start" and
 52 ((process.name : "net.exe" or ?process.pe.original_file_name == "net.exe") or ((process.name : "net1.exe" or ?process.pe.original_file_name == "net1.exe") and
 53 not process.parent.name : "net.exe")) and
 54 process.args : "use" and
 55 /* including hidden and webdav based online shares such as onedrive  */
 56 process.args : ("\\\\*\\*$*", "\\\\*@SSL\\*", "http*") and
 57 /* excluding shares deletion operation */
 58 not process.args : "/d*"
 59'''
 60
 61
 62[[rule.threat]]
 63framework = "MITRE ATT&CK"
 64[[rule.threat.technique]]
 65id = "T1021"
 66name = "Remote Services"
 67reference = "https://attack.mitre.org/techniques/T1021/"
 68[[rule.threat.technique.subtechnique]]
 69id = "T1021.002"
 70name = "SMB/Windows Admin Shares"
 71reference = "https://attack.mitre.org/techniques/T1021/002/"
 72
 73
 74
 75[rule.threat.tactic]
 76id = "TA0008"
 77name = "Lateral Movement"
 78reference = "https://attack.mitre.org/tactics/TA0008/"
 79[[rule.threat]]
 80framework = "MITRE ATT&CK"
 81[[rule.threat.technique]]
 82id = "T1078"
 83name = "Valid Accounts"
 84reference = "https://attack.mitre.org/techniques/T1078/"
 85[[rule.threat.technique.subtechnique]]
 86id = "T1078.003"
 87name = "Local Accounts"
 88reference = "https://attack.mitre.org/techniques/T1078/003/"
 89
 90
 91
 92[rule.threat.tactic]
 93id = "TA0001"
 94name = "Initial Access"
 95reference = "https://attack.mitre.org/tactics/TA0001/"
 96[[rule.threat]]
 97framework = "MITRE ATT&CK"
 98[[rule.threat.technique]]
 99id = "T1087"
100name = "Account Discovery"
101reference = "https://attack.mitre.org/techniques/T1087/"
102[[rule.threat.technique.subtechnique]]
103id = "T1087.001"
104name = "Local Account"
105reference = "https://attack.mitre.org/techniques/T1087/001/"
106
107[[rule.threat.technique.subtechnique]]
108id = "T1087.002"
109name = "Domain Account"
110reference = "https://attack.mitre.org/techniques/T1087/002/"
111
112
113
114[rule.threat.tactic]
115id = "TA0007"
116name = "Discovery"
117reference = "https://attack.mitre.org/tactics/TA0007/"