Mounting Hidden or WebDav Remote Shares

  1[metadata]
  2creation_date = "2020/11/02"
  3integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
  4maturity = "production"
  5updated_date = "2024/10/15"
  6min_stack_version = "8.14.0"
  7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Identifies the use of net.exe to mount a WebDav or hidden remote share. This may indicate lateral movement or
 13preparation for data exfiltration.
 14"""
 15from = "now-9m"
 16index = [
 17    "logs-endpoint.events.process-*",
 18    "winlogbeat-*",
 19    "logs-windows.forwarded*",
 20    "logs-windows.sysmon_operational-*",
 21    "endgame-*",
 22    "logs-system.security*",
 23    "logs-m365_defender.event-*",
 24    "logs-sentinel_one_cloud_funnel.*",
 25]
 26language = "eql"
 27license = "Elastic License v2"
 28name = "Mounting Hidden or WebDav Remote Shares"
 29risk_score = 47
 30rule_id = "c4210e1c-64f2-4f48-b67e-b5a8ffe3aa14"
 31severity = "medium"
 32tags = [
 33    "Domain: Endpoint",
 34    "OS: Windows",
 35    "Use Case: Threat Detection",
 36    "Tactic: Initial Access",
 37    "Tactic: Lateral Movement",
 38    "Data Source: Elastic Endgame",
 39    "Data Source: Elastic Defend",
 40    "Data Source: System",
 41    "Data Source: Microsoft Defender for Endpoint",
 42    "Data Source: Sysmon",
 43    "Data Source: SentinelOne",
 44]
 45timestamp_override = "event.ingested"
 46type = "eql"
 47
 48query = '''
 49process where host.os.type == "windows" and event.type == "start" and
 50 ((process.name : "net.exe" or ?process.pe.original_file_name == "net.exe") or ((process.name : "net1.exe" or ?process.pe.original_file_name == "net1.exe") and
 51 not process.parent.name : "net.exe")) and
 52 process.args : "use" and
 53 /* including hidden and webdav based online shares such as onedrive  */
 54 process.args : ("\\\\*\\*$*", "\\\\*@SSL\\*", "http*") and
 55 /* excluding shares deletion operation */
 56 not process.args : "/d*"
 57'''
 58
 59
 60[[rule.threat]]
 61framework = "MITRE ATT&CK"
 62[[rule.threat.technique]]
 63id = "T1021"
 64name = "Remote Services"
 65reference = "https://attack.mitre.org/techniques/T1021/"
 66[[rule.threat.technique.subtechnique]]
 67id = "T1021.002"
 68name = "SMB/Windows Admin Shares"
 69reference = "https://attack.mitre.org/techniques/T1021/002/"
 70
 71
 72
 73[rule.threat.tactic]
 74id = "TA0008"
 75name = "Lateral Movement"
 76reference = "https://attack.mitre.org/tactics/TA0008/"
 77[[rule.threat]]
 78framework = "MITRE ATT&CK"
 79[[rule.threat.technique]]
 80id = "T1078"
 81name = "Valid Accounts"
 82reference = "https://attack.mitre.org/techniques/T1078/"
 83[[rule.threat.technique.subtechnique]]
 84id = "T1078.003"
 85name = "Local Accounts"
 86reference = "https://attack.mitre.org/techniques/T1078/003/"
 87
 88
 89
 90[rule.threat.tactic]
 91id = "TA0001"
 92name = "Initial Access"
 93reference = "https://attack.mitre.org/tactics/TA0001/"
 94[[rule.threat]]
 95framework = "MITRE ATT&CK"
 96[[rule.threat.technique]]
 97id = "T1087"
 98name = "Account Discovery"
 99reference = "https://attack.mitre.org/techniques/T1087/"
100[[rule.threat.technique.subtechnique]]
101id = "T1087.001"
102name = "Local Account"
103reference = "https://attack.mitre.org/techniques/T1087/001/"
104
105[[rule.threat.technique.subtechnique]]
106id = "T1087.002"
107name = "Domain Account"
108reference = "https://attack.mitre.org/techniques/T1087/002/"
109
110
111
112[rule.threat.tactic]
113id = "TA0007"
114name = "Discovery"
115reference = "https://attack.mitre.org/tactics/TA0007/"