Remote Execution via File Shares

This detection identifies potential lateral movement within a Windows environment through the use of network file shares. It focuses on detecting the execution of files that were initially created or modified by the "NT AUTHORITY\SYSTEM" account (PID 4), which is often associated with the virtual system process responsible for file sharing activities. The rule looks for executable files (e.g., .exe, .scr, .com) that are created on a network share and then executed on another system. This is a common technique used by attackers to propagate malware or execute commands on multiple machines within a network. The detection logic leverages Elastic Endpoint data to correlate file creation/modification events with subsequent process execution events.

Attack Chain

1. An attacker gains initial access to a system within the network.
2. The attacker uploads or creates a malicious executable (e.g., a reverse shell or credential harvesting tool) on a network file share accessible to other systems.
3. The file creation event is logged with process.pid == 4, indicating that the file was created by the "NT AUTHORITY\SYSTEM" account when accessed through a network share.
4. A user on a different system navigates to the network share and executes the malicious executable.
5. The system logs a process start event for the executed file, capturing details such as the process name, path, and associated user account.
6. The detection rule identifies this sequence of events, matching the file creation on the network share with the subsequent execution on another system.
7. The attacker gains a foothold on the second system and may proceed to escalate privileges or move laterally to other systems.
8. The attacker achieves their objective, such as data exfiltration, system compromise, or ransomware deployment.

Impact

Successful exploitation can lead to widespread compromise across the network. Attackers can use this technique to rapidly spread malware, gain access to sensitive data, or disrupt critical business operations. The potential damage includes data breaches, financial losses, and reputational damage. Because the attack leverages legitimate network file sharing services, it can be difficult to detect and prevent without proper monitoring and security controls.

Recommendation

• Deploy the Sigma rule "Remote Execution via File Shares" to your SIEM to detect potential lateral movement activities (rule.query).
• Investigate any alerts generated by the Sigma rule to determine the scope and impact of the potential attack (rule.query).
• Review and restrict write access to network shares to minimize the risk of unauthorized file creation (metadata.description).
• Enable Sysmon file creation and process creation logging to ensure the required data is available for detection (index).