Detect Network Share Discovery in CrowdStrike LogScale
Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. File sharing over a Windows network occurs over the SMB protocol. Net can be used to query a remote system for available shared drives using the net view \\remotesystem command. It can also be used to query shared drives on the local system using net share. For macOS, the sharing -l command lists all shared points used for SMB services. Adversaries including Conti, BlackByte, Medusa, Latrodectus, QakBot, and Cuba have all leveraged network share discovery as a precursor to lateral movement, ransomware staging, and data collection operations, frequently calling NetShareEnum() directly or through net.exe wrappers.
MITRE ATT&CK
- Tactic
- Discovery
- Technique
- T1135 Network Share Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1135/
LogScale Detection Query
#event_simpleName=ProcessRollup2
| eval img_lower=lower(ImageFileName)
| eval cmd_lower=lower(CommandLine)
| where
(
// net.exe / net1.exe view or share - QakBot, Latrodectus, Kwampirs
(match(img_lower, /\\net1?\.exe$/) and (match(cmd_lower, /\bview\b/) or match(cmd_lower, /\bshare\b/)))
// PowerShell SMB / WMI share enumeration
or (match(img_lower, /\\(powershell|pwsh)\.exe$/) and match(cmd_lower, /(get-smbshare|win32_share|netshareenum|net share|net view)/))
// wmic.exe Win32_Share
or (match(img_lower, /\\wmic\.exe$/) and match(cmd_lower, /(win32_share|\bshare\b)/))
// nbtscan - Tonto Team recon tool
or match(img_lower, /\\nbtscan\.exe$/)
// CrackMapExec SMB shares - APT39
or (match(cmd_lower, /(crackmapexec|\bcme\b)/) and match(cmd_lower, /(\bsmb\b|--shares)/))
)
| eval IsRemoteView=if(match(img_lower, /\\net1?\.exe$/) and match(cmd_lower, /\bview\b/) and (match(cmd_lower, /\\\\/) or match(cmd_lower, /\/all/)), 1, 0)
| eval IsLocalShare=if(match(img_lower, /\\net1?\.exe$/) and match(cmd_lower, /\bshare\b/) and not(match(cmd_lower, /(add|delete)/)), 1, 0)
| eval IsNetAllDomain=if(match(img_lower, /\\net1?\.exe$/) and match(cmd_lower, /\bview\b/) and match(cmd_lower, /\/all/), 1, 0)
| eval IsPowerShellEnum=if(match(img_lower, /\\(powershell|pwsh)\.exe$/) and match(cmd_lower, /(get-smbshare|win32_share|netshareenum)/), 1, 0)
| eval IsWmicEnum=if(match(img_lower, /\\wmic\.exe$/) and match(cmd_lower, /(win32_share|\bshare\b)/), 1, 0)
| eval IsSuspiciousTool=if(match(img_lower, /\\nbtscan\.exe$/) or (match(cmd_lower, /(crackmapexec|\bcme\b)/) and match(cmd_lower, /(\bsmb\b|--shares)/)), 1, 0)
| eval SuspicionScore=IsRemoteView + IsLocalShare + IsNetAllDomain + IsPowerShellEnum + IsWmicEnum + IsSuspiciousTool
| where SuspicionScore > 0
| groupBy([ComputerName, UserName, ImageFileName, CommandLine, ParentImageFileName, ParentCommandLine, IsRemoteView, IsLocalShare, IsNetAllDomain, IsPowerShellEnum, IsWmicEnum, IsSuspiciousTool, SuspicionScore], function=count(as=EventCount))
| sort(SuspicionScore, order=desc)CrowdStrike LogScale (CQL) query targeting ProcessRollup2 events to detect network share discovery via net.exe/net1.exe view and share subcommands, PowerShell Get-SmbShare/Win32_Share/NetShareEnum, wmic.exe Win32_Share queries, nbtscan, and CrackMapExec SMB share enumeration. Results are grouped and scored by detection subtype for analyst triage.
Data Sources
Required Tables
False Positives & Tuning
- IT helpdesk personnel running net view to diagnose file share access problems for end users
- Automated inventory scripts using PowerShell Get-SmbShare or wmic Win32_Share queries on file servers
- Authorized red team assessments or penetration testers with documented scope using CrackMapExec or nbtscan against in-scope hosts
Other platforms for T1135
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 Enumerate Local Shares with net share
Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\net.exe (or net1.exe), CommandLine='net share', ParentImage=cmd.exe or powershell.exe. Security Event ID 4688 if command line auditing is enabled via GPO.
- Test 2 Enumerate All Domain Network Shares with net view /all
Expected signal: Sysmon Event ID 1: Process Create with CommandLine='net view /all /domain'. Sysmon Event ID 3: Multiple outbound SMB connections (port 445) to domain controllers and other hosts. Windows Security Event ID 5145 on accessed servers for each share access check. DNS queries for domain host resolution.
- Test 3 Query Specific Remote Host Shares via UNC Path
Expected signal: Sysmon Event ID 1: Process Create with CommandLine containing 'net view \\\\' followed by the resolved hostname. Sysmon Event ID 3: SMB connection to the target host on port 445. Windows Security Event ID 5140 and 5145 on the target host recording the source account and enumerated share names.
- Test 4 PowerShell WMI Network Share Enumeration via Win32_Share
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Win32_Share'. PowerShell ScriptBlock Log Event ID 4104 with the full WMI query and returned share objects. Module load events (Sysmon Event ID 7) for WMI-related DLLs.
- Test 5 SMB Share Enumeration via PowerShell Get-SmbShare Cmdlet
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-SmbShare'. PowerShell ScriptBlock Log Event ID 4104 with the full cmdlet invocation and output. Sysmon Event ID 7: Module load for SmbShare module DLLs (Microsoft.SMBServer.*).
References (8)
- https://attack.mitre.org/techniques/T1135/
- https://technet.microsoft.com/library/cc770880.aspx
- https://en.wikipedia.org/wiki/Shared_resource
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1135/T1135.md
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5140
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5145
- https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/
Response Playbook
Triage
- Identify the user account and device type — is this a standard user endpoint, a server, or a privileged admin host? Net view/net share on a standard user workstation with no open helpdesk ticket is significantly more suspicious than the same command on a dedicated IT admin workstation.
- Examine the parent process — was net.exe spawned by cmd.exe launched from a document (winword.exe, excel.exe), a web browser, a scripting engine (wscript.exe, cscript.exe, mshta.exe), or a service? These parent processes indicate initial access or phishing-stage execution. Legitimate admin use typically originates from interactive cmd.exe, PowerShell, or explorer.exe.
- Assess the enumeration scope: did the command target a specific host via UNC path (net view \\hostname), enumerate the entire domain (/all or /all /domain), or only query the local system (net share)? Domain-wide enumeration from a standard endpoint is far more indicative of automated malware reconnaissance than a targeted single-host query.
- Check the timing — does this occur during normal business hours for the user's timezone, or at night and on weekends? Ransomware pre-staging (Conti, Medusa, BlackByte) frequently performs share enumeration outside business hours to reduce detection likelihood.
- Look for a discovery command cluster in the 15 minutes before and after this event: systeminfo.exe, ipconfig.exe, whoami.exe, nltest.exe, net user, net group, tasklist, arp -a. A burst of multiple discovery commands from one host is a strong ransomware or post-exploitation indicator.
- Check for subsequent SMB connections — did the device establish new SMB connections (port 445) to previously unseen internal hosts within 10 minutes of the share enumeration? This may indicate immediate lateral movement to discovered shares.
Containment
- If share enumeration is immediately followed by new SMB connections to internal hosts or file staging activity, isolate the endpoint via EDR network isolation to prevent lateral spread across discovered share paths.
- If a privileged account (service account, domain admin, local admin) is involved, disable the account in Active Directory, force credential reset, and audit all systems that account has accessed in the preceding 48 hours.
- Block the identified source host from SMB access (TCP 445) to critical file servers and domain controllers using host-based firewall policy or network segment ACLs while investigation proceeds.
- If ransomware indicators are co-present (volume shadow copy deletion via vssadmin, rapid mass file modifications, services being stopped), activate full incident response procedures and consider isolating the affected network segment.
- Audit and temporarily tighten access to administrative shares (C$, ADMIN$, IPC$) on critical servers if lateral movement via admin shares is suspected — restrict access to explicitly authorized admin accounts only pending investigation.
Evidence Collection
- Process Creation Events — Sysmon Event ID 1 or Security Event ID 4688 (requires command line auditing GPO) from the source endpoint, capturing the full net.exe or PowerShell command line with all arguments and parent process context.
- Windows Security Log — Event ID 5140 (A network share object was accessed) and Event ID 5145 (A network share object was checked to see whether client can be granted desired access) on target file servers, capturing source IP, source account, share name, and access mask for all enumeration attempts.
- Network Connection Events — Sysmon Event ID 3 for outbound SMB connections (TCP 445) from the source host. Correlate connection destinations with shares returned by the enumeration to identify which discovered shares were subsequently accessed.
- Prefetch Files — C:\Windows\Prefetch\NET.EXE-*.pf and NET1.EXE-*.pf contain execution timestamps and referenced file paths, providing reliable evidence of when share enumeration occurred even if event logs have been cleared.
- PowerShell ScriptBlock Logging (Event ID 4104) — if enumeration used PowerShell, captures the full deobfuscated script including any Get-SmbShare, Win32_Share, or NetShareEnum calls, along with the output objects if collected.
- EDR Process Tree — retrieve the full process tree for the suspicious net.exe or PowerShell process, tracing back to the root parent to identify the initial execution vector (document, scheduled task, lateral movement, service).
- File System Artifacts — search %TEMP%, %APPDATA%, and user profile directories for any output redirection files (e.g., shares.txt, out.txt) that may contain the enumerated share list staged for exfiltration.
- DNS and NetBIOS Logs — review DNS query logs and NetBIOS name resolution for resolution of hostnames corresponding to the UNC paths used in net view commands, which can reveal target selection methodology.
Escalation Criteria
- !Share enumeration followed within 10 minutes by new SMB connections (Sysmon Event ID 3, port 445) to previously uncontacted internal hosts — strong indicator of active lateral movement to discovered shares.
- !Discovery command cluster: share enumeration co-occurring within 5 minutes with 3 or more other discovery techniques (systeminfo, ipconfig, whoami, net user, tasklist) from the same host — consistent with ransomware or post-exploitation framework automated reconnaissance.
- !Presence of offensive tooling (CrackMapExec, NBTscan, Impacket smbclient.py) — these have no legitimate enterprise use and confirm deliberate attacker activity regardless of share enumeration findings.
- !Enumeration performed by a service account, machine account, or account that does not normally run interactive commands — indicates credential compromise or living-off-the-land lateral movement using harvested credentials.
- !Net view /all or /all /domain executed from a standard user endpoint — domain-wide enumeration from non-admin hosts is not legitimate behavior and indicates active attacker reconnaissance at scale.
- !Volume shadow copy deletion (vssadmin delete shadows, wmic shadowcopy delete) observed within 30 minutes of share enumeration — this is a near-definitive ransomware pre-encryption indicator requiring immediate IR escalation.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Windows Security Event Log: Event ID 5140 (Network Share Object Accessed) on target servers — records source IP, account name, share name, and access type for each enumeration probe. - >
Windows Security Event Log: Event ID 5145 (Network Share Object Access Check) on target servers — fires on each access check during enumeration even without successful file access, capturing granular enumeration telemetry. - >
Windows Security Event Log: Event ID 4688 (Process Creation with command line auditing) or Sysmon Event ID 1 on the source host — net.exe command line with 'view' or 'share' subcommand and all arguments. - >
Prefetch: C:\Windows\Prefetch\NET.EXE-*.pf and NET1.EXE-*.pf — execution timestamps, run count, and loaded DLL references confirming share enumeration activity. - >
File System: %TEMP%, %USERPROFILE%\Desktop, and %APPDATA% — search for text files containing share lists (e.g., output redirected via 'net view > shares.txt'), which indicate deliberate collection of enumeration output. - >
Registry: HKCU\Network — mapped network drives that may have been established by the attacker after discovering shares, persisting through logoffs. - >
PowerShell History: %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt — may contain Get-SmbShare, WMI Win32_Share queries, or net.exe wrappers from interactive sessions. - >
SMB PCAP / NetFlow: Network captures showing NTLMSSP authentication followed by NetShareEnum (SRVSVC pipe) or TreeConnect requests to target hosts, capturing the enumeration at the protocol level independent of endpoint telemetry.
Tuning Guidance
The primary false positive challenge for T1135 is legitimate IT administration — net view and net share are built-in Windows tools regularly used by helpdesk and sysadmin teams. Start by building an allowlist of known IT admin accounts and their dedicated workstations: these can be excluded by AccountName combined with DeviceName. For monitoring agents and backup products, identify their specific parent process names (e.g., beremote.exe for Backup Exec, VeeamAgent.exe for Veeam) and add parent-process exclusions rather than blanket account exclusions. Consider tiering alert severity by context: a single 'net share' command on an identified admin workstation during business hours warrants low-severity notification, while 'net view /all /domain' from a standard user endpoint at 3 AM co-occurring with other discovery commands should auto-escalate to critical. Highest confidence signals requiring immediate investigation regardless of context: (1) net.exe spawned by document applications or scripting engines, (2) offensive tooling (CrackMapExec, NBTscan) which have no legitimate enterprise use, (3) discovery command clusters with 3+ techniques within 5 minutes, and (4) share enumeration immediately followed by new SMB connections to internal hosts. For environments with Active Directory, enabling Object Access auditing for network share access (Security Policy: Audit File Share) and capturing Event IDs 5140 and 5145 on critical file servers provides valuable server-side telemetry that catches attackers using direct API calls (NetShareEnum via Conti, Cuba) that bypass process-based detections entirely.
Hunting Queries
Hunt for network share enumeration launched from unusual parent processes. Legitimate administrative use of net view/share typically originates from cmd.exe, PowerShell, or Explorer. When net.exe is spawned by document applications (winword.exe, excel.exe), scripting engines (wscript.exe, mshta.exe), browsers, or remote service processes, it is a strong indicator of malicious execution within an attack chain — consistent with phishing-delivered malware performing automated post-exploitation discovery.
// Hunt for share enumeration spawned by unusual parent processes (not cmd.exe, PowerShell, or Explorer)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("net.exe", "net1.exe")
| where ProcessCommandLine has_any (" view", " share")
| where InitiatingProcessFileName !in~ (
"cmd.exe", "powershell.exe", "pwsh.exe", "explorer.exe",
"conhost.exe", "bash.exe"
)
| summarize
Count=count(),
Devices=dcount(DeviceName),
Accounts=make_set(AccountName),
Commands=make_set(ProcessCommandLine)
by InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Count descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(match(lower(Image), "\\\\net(1)?\\.exe$"))
(match(lower(CommandLine), "(\\bview\\b|\\bshare\\b)"))
NOT (ParentImage="*\\cmd.exe" OR ParentImage="*\\powershell.exe" OR ParentImage="*\\pwsh.exe" OR ParentImage="*\\explorer.exe" OR ParentImage="*\\conhost.exe")
| stats count as Count, dc(host) as Devices, values(User) as Accounts, values(CommandLine) as Commands by ParentImage, ParentCommandLine
| sort - CountHunt for discovery command clustering — multiple distinct reconnaissance tools executed from the same host and user within a 5-minute window that includes share enumeration. Ransomware operators (Conti, Medusa, BlackByte) and post-exploitation frameworks (Cobalt Strike, Metasploit, Sliver, Havoc) execute automated discovery playbooks after initial compromise. Three or more distinct discovery binaries used within 5 minutes of net view/net share is a high-fidelity indicator of active attacker presence.
// Hunt for discovery command clusters - 3+ recon techniques from same host within 5 minutes
let DiscoveryBehaviors = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("net.exe", "net1.exe", "systeminfo.exe", "ipconfig.exe", "whoami.exe",
"nltest.exe", "nbtstat.exe", "arp.exe", "route.exe", "netstat.exe")
or (FileName in~ ("powershell.exe", "pwsh.exe") and
ProcessCommandLine has_any ("Get-SmbShare", "Win32_Share", "Get-ADDomain", "Get-NetLocalGroup", "Get-NetUser"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine;
DiscoveryBehaviors
| join kind=inner (
DiscoveryBehaviors
| where FileName in~ ("net.exe", "net1.exe")
| where ProcessCommandLine has_any (" view", " share")
| project PivotTime=Timestamp, DeviceName, AccountName
) on DeviceName, AccountName
| where abs(datetime_diff('second', Timestamp, PivotTime)) <= 300
| summarize
TechniqueCount=dcount(FileName),
CommandCount=count(),
Tools=make_set(FileName),
Commands=make_set(ProcessCommandLine)
by DeviceName, AccountName, bin(PivotTime, 5m)
| where TechniqueCount >= 3
| sort by TechniqueCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(match(lower(Image), "\\\\(net(1)?|systeminfo|ipconfig|whoami|nltest|nbtstat|arp|route|netstat)\\.exe$")
OR (match(lower(Image), "\\\\(powershell|pwsh)\\.exe$") AND match(lower(CommandLine), "(get-smbshare|win32_share|get-addomain|get-netlocalgroup)")))
| bucket _time span=5m
| stats dc(Image) as ToolCount, count as CmdCount, values(Image) as Tools, values(CommandLine) as Commands by _time, host, User
| where ToolCount >= 3
| sort - ToolCountHunt for SMB connections that follow network share enumeration from the same host within a 10-minute window. Conti, QakBot, and BlackByte ransomware enumerate shares and then immediately pivot to those shares for lateral movement, tool transfer, or data staging. New outbound SMB connections (port 445) to internal hosts shortly after share discovery is one of the clearest behavioral indicators of an attacker transitioning from reconnaissance to active lateral movement.
// Hunt for SMB lateral movement immediately following share enumeration on the same device
let ShareDiscovery = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("net.exe", "net1.exe")
| where ProcessCommandLine has_any (" view", " share")
| project DiscoveryTime=Timestamp, DeviceName, AccountName, DiscoveryCmd=ProcessCommandLine;
ShareDiscovery
| join kind=inner (
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort == 445
| where RemoteIPType !in ("Loopback", "LinkLocal")
| project ConnectionTime=Timestamp, DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine
) on DeviceName
| where ConnectionTime > DiscoveryTime
| where ConnectionTime < datetime_add('minute', 10, DiscoveryTime)
| project
DiscoveryTime, ConnectionTime,
SecondsAfterDiscovery=datetime_diff('second', ConnectionTime, DiscoveryTime),
DeviceName, AccountName, DiscoveryCmd,
RemoteIP, RemoteUrl, InitiatingProcessFileName
| sort by DiscoveryTime descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
match(lower(Image), "\\\\net(1)?\\.exe$") (match(lower(CommandLine), "\\bview\\b") OR match(lower(CommandLine), "\\bshare\\b"))
| eval disc_time=_time, host_key=host
| table disc_time, host_key, User, CommandLine
| join type=inner host_key [
search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
DestinationPort=445
NOT (DestinationIp="127.*" OR DestinationIp="::1")
| eval conn_time=_time, host_key=host
| table conn_time, host_key, DestinationIp, DestinationHostname, Image
]
| where conn_time > disc_time AND conn_time < disc_time+600
| eval SecondsLater=conn_time-disc_time
| table disc_time, conn_time, SecondsLater, host_key, User, CommandLine, DestinationIp, DestinationHostname, Image
| sort - disc_timeAtomic Red Team Tests
Uses the built-in net.exe to list all shared resources on the local system. This is the simplest form of share discovery, used by Kwampirs (Symantec 2018) and QakBot to identify what the compromised host is sharing before probing the wider network. Generates a process creation event with 'net share' in the command line and produces output listing all local shares including administrative shares (C$, ADMIN$, IPC$).
Command
net shareExpected Telemetry
Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\net.exe (or net1.exe), CommandLine='net share', ParentImage=cmd.exe or powershell.exe. Security Event ID 4688 if command line auditing is enabled via GPO.
Expected Detection
Alert fires on FileName=net.exe with 'share' in ProcessCommandLine. KQL: IsLocalShare=true. SPL: IsLocalShare=1, SuspicionScore=1.
Uses net.exe to enumerate all shared resources across the entire domain — the broadest form of share discovery. Used verbatim by Latrodectus ('net view /all'), and functionally equivalent to Conti and BlackByte domain-wide enumeration. This command generates significant SMB/NetBIOS network traffic and enumerates every accessible share across domain-joined hosts.
Command
net view /all /domainExpected Telemetry
Sysmon Event ID 1: Process Create with CommandLine='net view /all /domain'. Sysmon Event ID 3: Multiple outbound SMB connections (port 445) to domain controllers and other hosts. Windows Security Event ID 5145 on accessed servers for each share access check. DNS queries for domain host resolution.
Expected Detection
Alert fires on net.exe with both 'view' and '/all'. KQL: IsRemoteView=true, IsNetAllDomain=true. SPL: IsRemoteView=1, IsNetAllDomain=1, SuspicionScore=2. Highest priority alert variant due to domain-wide enumeration scope.
Uses net view with a specific UNC path to enumerate shares on a targeted remote system. This targeted variant is the pattern seen in BADHATCH (checking C$ share access on compromised machines) and post-exploitation frameworks that identify high-value targets (file servers, DCs) and enumerate them individually. Using %COMPUTERNAME% keeps this test safe by querying the local machine's own shares via the network stack.
Command
net view \\%COMPUTERNAME%Expected Telemetry
Sysmon Event ID 1: Process Create with CommandLine containing 'net view \\\\' followed by the resolved hostname. Sysmon Event ID 3: SMB connection to the target host on port 445. Windows Security Event ID 5140 and 5145 on the target host recording the source account and enumerated share names.
Expected Detection
Alert fires on net.exe with 'view' and UNC path (\\\\). KQL: IsRemoteView=true. SPL: IsRemoteView=1, SuspicionScore=1.
Uses PowerShell with the WMI Win32_Share class to enumerate all shares — both local and those accessible via WMI. This method avoids spawning net.exe and bypasses process-name based detections, using instead a WMI query that returns share objects. Conti ransomware uses the equivalent NetShareEnum() Win32 API call; this test exercises the PowerShell/WMI path that emulates that behavior at a higher abstraction level.
Command
powershell.exe -NoProfile -Command "Get-WmiObject -Class Win32_Share | Select-Object Name, Path, Type, Description | Format-Table -AutoSize"Expected Telemetry
Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Win32_Share'. PowerShell ScriptBlock Log Event ID 4104 with the full WMI query and returned share objects. Module load events (Sysmon Event ID 7) for WMI-related DLLs.
Expected Detection
Alert fires on PowerShell with 'Win32_Share' in ProcessCommandLine. KQL: IsPowerShellWmi=true. SPL: IsPowerShellEnum=1, SuspicionScore=1.
Uses the PowerShell SmbShare module cmdlet to enumerate local SMB shares — a modern, operator-friendly approach increasingly seen in red team engagements and living-off-the-land post-exploitation. Get-SmbShare returns richer share metadata than net share and is harder to detect with simple string matching due to its benign administrative appearance. Tests whether detection logic covers PowerShell SMB module usage.
Command
powershell.exe -NoProfile -Command "Get-SmbShare | Select-Object Name, Path, ScopeName, ShareState, ConcurrentUserLimit | Format-Table -AutoSize"Expected Telemetry
Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-SmbShare'. PowerShell ScriptBlock Log Event ID 4104 with the full cmdlet invocation and output. Sysmon Event ID 7: Module load for SmbShare module DLLs (Microsoft.SMBServer.*).
Expected Detection
Alert fires on PowerShell with 'Get-SmbShare'. KQL: IsPowerShellWmi=true. SPL: IsPowerShellEnum=1, SuspicionScore=1.