Sigma rule: Suspicious Get Information for SMB Share - PowerShell Module

Rule

Title

Suspicious Get Information for SMB Share - PowerShell Module

Status

test

Level

low

Author

frack113

Date

2021-12-15

Modified

2022-12-02

File

rules/windows/powershell/powershell_module/posh_pm_susp_smb_share_reco.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and
to identify potential systems of interest for Lateral Movement.
Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.

Log source

product

windows

category

ps_module

definition

0ad03ef1-f21b-4a79-8ce8-e6900c54b65b

Detection

selection:
    - Payload|contains: get-smbshare
    - ContextInfo|contains: get-smbshare
condition: selection

False positives (as the rule lists them)

• Administrator script

Tags

• attack.discovery
• attack.t1069.001

MITRE ATT&CK ids this rule names

• T1069.001

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_module/posh_pm_susp_smb_share_reco.yml