Detection of Suspicious New-PSDrive Mapping to Administrative Shares

Adversaries often leverage PowerShell to facilitate lateral movement within compromised environments. A common technique involves the use of the New-PSDrive cmdlet to map remote network shares, specifically administrative shares (e.g., C$, ADMIN$), using the Server Message Block (SMB) protocol. By creating a temporary drive mapping, an attacker can interact with remote file systems, execute tools, or exfiltrate sensitive data as the currently logged-on user. This activity is frequently observed during the post-exploitation phase of an intrusion, where attackers attempt to pivot from a single compromised host to other systems within the network. Defenders should monitor PowerShell Script Block Logging (Event ID 4104) to identify these drive mappings, as they are often indicative of malicious administrative activity.

Impact

Successful exploitation of this technique allows attackers to move laterally across an environment, bypass local security controls by accessing remote resources, and potentially escalate privileges if the current session has appropriate permissions on the target host.

Recommendation

Detection engineering teams should focus on identifying unauthorized PowerShell usage of network drive mappings.

• Enable PowerShell Script Block Logging (Event ID 4104) to capture the full command-line context of script execution.
• Deploy the provided Sigma rule to detect the specific pattern of New-PSDrive parameters associated with admin share mapping.
• Investigate any host triggering this rule to determine if the activity is part of an authorized administrative task or unauthorized lateral movement.