Remote Service Access from Workstation

Use case development / Monitor Network Anomalies / Detect Lateral Movement

sigma

Detection rule

title: SMB Lateral Movement from Workstation
status: experimental
description: Detects SMB connections from workstations to multiple internal hosts
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5140
    ShareName|contains: 'ADMIN$'
  condition: selection | count(ObjectName) by SubjectUserName > 5
  timeframe: 1h
falsepositives:
  - IT administration
level: medium
tags:
  - attack.lateral_movement
  - attack.t1021.002

Test cases

• Access ADMIN$ on 6+ workstations in 1 hour

False positive guidance

Whitelist IT admin workstations and scripts.

Detection course