SMB Create Remote File Admin Share

Title: SMB Create Remote File Admin Share
Status: test
Description:Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).
References:
  -https://github.com/OTRF/ThreatHunter-Playbook/blob/f7a58156dbfc9b019f17f638b8c62d22e557d350/playbooks/WIN-201012004336.yaml
  -https://securitydatasets.com/notebooks/atomic/windows/lateral_movement/SDWIN-200806015757.html?highlight=create%20file
Author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research)
Date: 2020-08-06
modified:2025-10-17
Tags:

• -'attack.lateral-movement'
• -'attack.t1021.002'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID: '5145'
    ShareName|endswith: 'C$'
    AccessMask: '0x2'
  filter_main_subjectusername:
    SubjectUserName|endswith: '$'
  filter_optional_local_ip:
    IpAddress: '::1'
  condition:selection and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
  -Unknown
Level: high