Suspicious Exe File Event With System Image

 1title: Suspicious Exe File Event With System Image
 2id: 2ace112a-1717-4648-b0f8-51796f36c58e
 3status: experimental
 4description: Detects potential SMB file creation activity associated with Impacket smbclient.py.
 5references:
 6    - https://github.com/fortra/impacket/blob/impacket_0_10_0/examples/smbclient.py
 7author: Micah Babinski
 8date: 2023/04/16
 9tags:
10    - attack.lateral_movement
11    - attack.t1105
12logsource:
13    product: windows
14    category: file_event
15detection:
16    selection:
17        TargetFilename|endswith: '.exe'
18        Image: System
19        User: 'NT Authority\Sytem'
20    condition: selection
21falsepositives:
22    - Unknown
23level: low```

References

• impacket/examples/smbclient.py at impacket_0_10_0 · fortra/impacket

  

  Impacket is a collection of Python classes for working with network protocols. - fortra/impacket

  
  Read More

Related rules

• Cisco Stage Data
• Executable Deployment from Remote Share
• Remote File Copy
• CobaltStrike Service Installations - System
• Potential RDP Exploit CVE-2019-0708