Operators probe which hosts accept their credentials by connecting to administrative shares across the network. Normal administration touches a handful of hosts you expect. A sweep touches many in a tight sequence, from a source that has no administrative role. It is one of the cleanest rule-based early warnings on the path to deployment.
Signals at a Glance
| Signal | Where | ATT&CK |
|---|---|---|
| One source accessing C$, ADMIN$ or IPC$ on many hosts | Security 5140 | T1021.002 |
| Share enumeration tools or net view across the domain | Sysmon 1, EDR | T1135 |
| Many SMB connection attempts to 445 from one host | Firewall, Zeek | T1046 |
| Remote system discovery commands against AD computers | Sysmon 1, EDR | T1018 |
| Network logons on many hosts by a single account | 4624 type 3 | T1078.002 |
Share Access Fan-Out
Enable the File Share audit subcategory on servers and workstations that you can afford to log, then count distinct destination hosts per source and share name:
index=wineventlog EventCode=5140 (Share_Name="\\*\C$" OR Share_Name="\\*\ADMIN$" OR Share_Name="\\*\IPC$")
| bin _time span=15m
| stats dc(ComputerName) as hosts values(Share_Name) as shares by _time Source_Address Account_Name
| where hosts >= 10
| sort - hosts
`comment("tune/validate: exclude asset-management, backup and scanner sources; Share_Name field format differs by add-on")`
Discovery Commands and Scanning
The sweep is usually preceded or accompanied by discovery commands. These are common in administration, so weight them by context: a workstation with no administrative function running them against a domain list is the signal.
title: Network Share and Remote System Discovery Burst
logsource:
category: process_creation
product: windows
detection:
shares:
CommandLine|contains:
- 'net view'
- 'net use'
- 'Get-SmbShare'
- 'Invoke-ShareFinder'
- 'SharpShares'
discovery:
CommandLine|contains:
- 'dsquery computer'
- 'Get-ADComputer'
- 'nltest /dclist'
condition: shares or discovery
level: low
# tune/validate: low on its own; escalate in a correlation rule with 5140 fan-out or credential access
- Block SMB between workstations with host firewall rules; most sweeps then fail loudly at the network layer.
- Alert on the combination of discovery commands and share fan-out from the same host within an hour.
- Isolate the sweeping host, then review which accounts it authenticated with on each target.
SigmaHQ discovery and administrative-share rules, Splunk ESCU SMB and share-enumeration analytics, Elastic lateral-movement content and MITRE CAR. Management tooling produces legitimate share access across the estate, so baseline those sources before alerting.
Build Detections That Fire
Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.
- Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
- Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
- 24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts