LoFP / security teams may leverage powerview proactively to identify and remediate sensitive file shares. filter as needed.

Techniques

• T1135

Sample rules

Windows File Share Discovery With Powerview

• source: splunk
• technicques:
  • T1135

Description

The following analytic detects the execution of the Invoke-ShareFinder PowerShell cmdlet from PowerView. This detection leverages PowerShell Script Block Logging to identify instances where this specific command is executed. Monitoring this activity is crucial as it indicates an attempt to enumerate network file shares, which may contain sensitive information such as backups, scripts, and credentials. If confirmed malicious, this activity could enable an attacker to escalate privileges or move laterally within the network, potentially compromising additional systems and sensitive data.

Detection logic

`powershell` EventCode=4104  (ScriptBlockText=Invoke-ShareFinder*) 
| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `windows_file_share_discovery_with_powerview_filter`