{"id":"T1021.002","name":"SMB/Windows Admin Shares","url":"https://attack.mitre.org/techniques/T1021/002","tactics":["lateral-movement"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0530","stix_id":"x-mitre-detection-strategy--04cbfa17-64a5-454d-8734-cead02ba5c43","name":"Multi-Event Detection for SMB Admin Share Lateral Movement","url":"https://attack.mitre.org/detectionstrategies/DET0530","analytics":[{"id":"AN1468","stix_id":"x-mitre-analytic--1a18402e-efb1-49c7-8615-dc907f838320","name":"Analytic 1468","description":"An SMB-based remote file share access followed by lateral movement actions such as remote service creation, task scheduling, or suspicious process execution on the target host using ADMIN$ or C$ shares.","url":"https://attack.mitre.org/detectionstrategies/DET0530#AN1468","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4624, 4648","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"ShareName","description":"Targeted admin share path, such as C$, ADMIN$, IPC$"},{"field":"TimeWindow","description":"Correlation window between remote file access and remote execution (e.g., 5-10 minutes)"},{"field":"UserContext","description":"Distinguish expected remote administrators vs. rare/first-time access by specific users"},{"field":"ProcessList","description":"List of suspicious binaries or tools executed post remote copy (e.g., cmd.exe, powershell.exe, runonce.exe)"}],"live":true,"detection_strategies":["DET0530"],"techniques":["T1021.002"]}],"live":true,"version":"1.0","techniques":["T1021.002"]}],"sigma_rules":[{"id":"021310d9-30a6-480a-84b7-eaa69aeb92bb","title":"First Time Seen Remote Named Pipe - Zeek","author":"Samir Bousseaden, @neu5ron, Tim Shelton","status":"test","level":"high","date":"2020-04-02","modified":"2022-12-27","description":"This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes","references":["https://twitter.com/menasec1/status/1104489274387451904"],"logsource":{"product":"zeek","service":"smb_files"},"tags":["attack.lateral-movement","attack.t1021.002"],"path":"rules/network/zeek/zeek_smb_converted_win_lm_namedpipe.yml","techniques":["T1021.002"],"cves":[]},{"id":"055fb54c-a8f4-4aee-bd44-f74cf30a0d9d","title":"HackTool - SharpMove Tool Execution","author":"Luca Di Bartolomeo (CrimpSec)","status":"test","level":"high","date":"2024-01-29","modified":null,"description":"Detects the execution of SharpMove, a .NET utility performing multiple tasks such as \"Task Creation\", \"SCM\" query, VBScript execution using WMI via its PE metadata and command line options.\n","references":["https://github.com/0xthirteen/SharpMove/","https://pentestlab.blog/tag/sharpmove/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.lateral-movement","attack.t1021.002"],"path":"rules/windows/process_creation/proc_creation_win_hktl_sharpmove.yml","techniques":["T1021.002"],"cves":[]},{"id":"098d7118-55bc-4912-a836-dc6483a8d150","title":"Access To ADMIN$ Network Share","author":"Florian Roth (Nextron Systems)","status":"test","level":"low","date":"2017-03-04","modified":"2024-01-16","description":"Detects access to ADMIN$ network share","references":["https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140"],"logsource":{"product":"windows","service":"security"},"tags":["attack.lateral-movement","attack.t1021.002"],"path":"rules/windows/builtin/security/win_security_admin_share_access.yml","techniques":["T1021.002"],"cves":[]},{"id":"183e7ea8-ac4b-4c23-9aec-b3dac4e401ac","title":"Net.EXE Execution","author":"Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)","status":"test","level":"low","date":"2019-01-16","modified":"2022-07-11","description":"Detects execution of \"Net.EXE\".","references":["https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/","https://eqllib.readthedocs.io/en/latest/analytics/4d2e7fc1-af0b-4915-89aa-03d25ba7805e.html","https://eqllib.readthedocs.io/en/latest/analytics/e61f557c-a9d0-4c25-ab5b-bbc46bb24deb.html","https://eqllib.readthedocs.io/en/latest/analytics/9b3dd402-891c-4c4d-a662-28947168ce61.html","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1007/T1007.md#atomic-test-2---system-service-discovery---netexe"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1007","attack.t1049","attack.t1018","attack.t1135","attack.t1201","attack.t1069.001","attack.t1069.002","attack.t1087.001","attack.t1087.002","attack.lateral-movement","attack.t1021.002","attack.s0039","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_net_execution.yml","techniques":["T1007","T1049","T1018","T1135","T1201","T1069.001","T1069.002","T1087.001","T1087.002","T1021.002"],"cves":[]},{"id":"1c563233-030e-4a07-af8c-ee0490a66d3a","title":"Suspicious New-PSDrive to Admin Share","author":"frack113","status":"test","level":"medium","date":"2022-08-13","modified":null,"description":"Adversaries may use to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.002/T1021.002.md#atomic-test-2---map-admin-share-powershell","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/new-psdrive?view=powershell-7.2"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.lateral-movement","attack.t1021.002"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_new_psdrive.yml","techniques":["T1021.002"],"cves":[]},{"id":"214e8f95-100a-4e04-bb31-ef6cba8ce07e","title":"DCERPC SMB Spoolss Named Pipe","author":"OTR (Open Threat Research)","status":"test","level":"medium","date":"2018-11-28","modified":"2022-08-11","description":"Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.","references":["https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1","https://dirkjanm.io/a-different-way-of-abusing-zerologon/","https://twitter.com/_dirkjan/status/1309214379003588608"],"logsource":{"product":"windows","service":"security"},"tags":["attack.lateral-movement","attack.t1021.002"],"path":"rules/windows/builtin/security/win_security_dce_rpc_smb_spoolss_named_pipe.yml","techniques":["T1021.002"],"cves":[]},{"id":"2f7979ae-f82b-45af-ac1d-2b10e93b0baa","title":"Potential DCOM InternetExplorer.Application DLL Hijack","author":"Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), wagga","status":"test","level":"critical","date":"2020-10-12","modified":"2022-12-18","description":"Detects potential DLL hijack of \"iertutil.dll\" found in the DCOM InternetExplorer.Application Class over the network","references":["https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.lateral-movement","attack.t1021.002","attack.t1021.003"],"path":"rules/windows/file/file_event/file_event_win_dcom_iertutil_dll_hijack.yml","techniques":["T1021.002","T1021.003"],"cves":[]},{"id":"32d56ea1-417f-44ff-822b-882873f5f43b","title":"Impacket PsExec Execution","author":"Bhabesh Raj","status":"test","level":"high","date":"2020-12-14","modified":"2022-09-22","description":"Detects execution of Impacket's psexec.py.","references":["https://web.archive.org/web/20230329171218/https://blog.menasec.net/2019/02/threat-hunting-3-detecting-psexec.html"],"logsource":{"product":"windows","service":"security"},"tags":["attack.lateral-movement","attack.t1021.002"],"path":"rules/windows/builtin/security/win_security_impacket_psexec.yml","techniques":["T1021.002"],"cves":[]},{"id":"3abd6094-7027-475f-9630-8ab9be7b9725","title":"Windows Admin Share Mount Via Net.EXE","author":"oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, wagga","status":"test","level":"medium","date":"2020-10-05","modified":"2023-02-21","description":"Detects when an admin share is mounted using net.exe","references":["https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.lateral-movement","attack.t1021.002"],"path":"rules/windows/process_creation/proc_creation_win_net_use_mount_admin_share.yml","techniques":["T1021.002"],"cves":[]},{"id":"45545954-4016-43c6-855e-eae8f1c369dc","title":"Protected Storage Service Access","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"high","date":"2019-08-10","modified":"2021-11-27","description":"Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers","references":["https://threathunterplaybook.com/hunts/windows/190620-DomainDPAPIBackupKeyExtraction/notebook.html"],"logsource":{"product":"windows","service":"security"},"tags":["attack.lateral-movement","attack.t1021.002"],"path":"rules/windows/builtin/security/win_security_protected_storage_service_access.yml","techniques":["T1021.002"],"cves":[]},{"id":"52a85084-6989-40c3-8f32-091e12e13f09","title":"smbexec.py Service Installation","author":"Omer Faruk Celik","status":"test","level":"high","date":"2018-03-20","modified":"2023-11-09","description":"Detects the use of smbexec.py tool by detecting a specific service installation","references":["https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-2-psexec-and-services/","https://github.com/fortra/impacket/blob/33058eb2fde6976ea62e04bc7d6b629d64d44712/examples/smbexec.py#L286-L296","https://github.com/fortra/impacket/blob/edef71f17bc1240f9f8c957bbda98662951ac3ec/examples/smbexec.py#L60"],"logsource":{"product":"windows","service":"system"},"tags":["attack.lateral-movement","attack.execution","attack.t1021.002","attack.t1569.002"],"path":"rules/windows/builtin/system/service_control_manager/win_system_hack_smbexec.yml","techniques":["T1021.002","T1569.002"],"cves":[]},{"id":"52d8b0c6-53d6-439a-9e41-52ad442ad9ad","title":"First Time Seen Remote Named Pipe","author":"Samir Bousseaden","status":"test","level":"high","date":"2019-04-03","modified":"2023-03-14","description":"This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes","references":["https://twitter.com/menasec1/status/1104489274387451904"],"logsource":{"product":"windows","service":"security"},"tags":["attack.lateral-movement","attack.t1021.002"],"path":"rules/windows/builtin/security/win_security_lm_namedpipe.yml","techniques":["T1021.002"],"cves":[]},{"id":"586a8d6b-6bfe-4ad9-9d78-888cd2fe50c3","title":"Remote Service Activity via SVCCTL Named Pipe","author":"Samir Bousseaden","status":"test","level":"medium","date":"2019-04-03","modified":"2024-08-01","description":"Detects remote service activity via remote access to the svcctl named pipe","references":["https://web.archive.org/web/20230329155141/https://blog.menasec.net/2019/03/threat-hunting-26-remote-windows.html"],"logsource":{"product":"windows","service":"security"},"tags":["attack.lateral-movement","attack.persistence","attack.t1021.002"],"path":"rules/windows/builtin/security/win_security_svcctl_remote_service.yml","techniques":["T1021.002"],"cves":[]},{"id":"5a105d34-05fc-401e-8553-272b45c1522d","title":"CobaltStrike Service Installations - System","author":"Florian Roth (Nextron Systems), Wojciech Lesicki","status":"test","level":"critical","date":"2021-05-26","modified":"2022-11-27","description":"Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement","references":["https://www.sans.org/webcasts/119395","https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/","https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/"],"logsource":{"product":"windows","service":"system"},"tags":["attack.persistence","attack.execution","attack.privilege-escalation","attack.lateral-movement","attack.t1021.002","attack.t1543.003","attack.t1569.002"],"path":"rules/windows/builtin/system/service_control_manager/win_system_cobaltstrike_service_installs.yml","techniques":["T1021.002","T1543.003","T1569.002"],"cves":[]},{"id":"5bb68627-3198-40ca-b458-49f973db8752","title":"Rundll32 Execution Without Parameters","author":"Bartlomiej Czyz, Relativity","status":"test","level":"high","date":"2021-01-31","modified":"2023-02-28","description":"Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module","references":["https://bczyz1.github.io/2021/01/30/psexec.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.lateral-movement","attack.t1021.002","attack.t1570","attack.execution","attack.t1569.002"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_without_parameters.yml","techniques":["T1021.002","T1570","T1569.002"],"cves":[]},{"id":"5cdb711b-5740-4fb2-ba88-f7945027afac","title":"Rundll32 UNC Path Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-10","modified":"2026-07-20","description":"Detects rundll32 execution where the DLL is located on a remote location (share).\nThreat actors can abuse the rundll32.exe binary to execute remote DLLs from a UNC pathh.\n","references":["https://www.cybereason.com/blog/rundll32-the-infamous-proxy-for-executing-malicious-code","https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.lateral-movement","attack.stealth","attack.t1021.002","attack.t1218.011"],"path":"rules/windows/process_creation/proc_creation_win_rundll32_unc_path.yml","techniques":["T1021.002","T1218.011"],"cves":[]},{"id":"614a7e17-5643-4d89-b6fe-f9df1a79641c","title":"Wmiprvse Wbemcomn DLL Hijack - File","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"critical","date":"2020-10-12","modified":"2022-12-02","description":"Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\\Windows\\System32\\wbem\\` directory over the network and loading it for a WMI DLL Hijack scenario.","references":["https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.t1047","attack.lateral-movement","attack.t1021.002"],"path":"rules/windows/file/file_event/file_event_win_wmiprvse_wbemcomn_dll_hijack.yml","techniques":["T1047","T1021.002"],"cves":[]},{"id":"61a7697c-cb79-42a8-a2ff-5f0cdfae0130","title":"Potential CobaltStrike Service Installations - Registry","author":"Wojciech Lesicki","status":"test","level":"high","date":"2021-06-29","modified":"2024-03-25","description":"Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.\n","references":["https://www.sans.org/webcasts/tech-tuesday-workshop-cobalt-strike-detection-log-analysis-119395"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.persistence","attack.execution","attack.privilege-escalation","attack.lateral-movement","attack.t1021.002","attack.t1543.003","attack.t1569.002"],"path":"rules/windows/registry/registry_set/registry_set_cobaltstrike_service_installs.yml","techniques":["T1021.002","T1543.003","T1569.002"],"cves":[]},{"id":"6fb63b40-e02a-403e-9ffd-3bcc1d749442","title":"Metasploit Or Impacket Service Installation Via SMB PsExec","author":"Bartlomiej Czyz, Relativity","status":"test","level":"high","date":"2021-01-21","modified":"2022-10-05","description":"Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation","references":["https://bczyz1.github.io/2021/01/30/psexec.html"],"logsource":{"product":"windows","service":"security"},"tags":["attack.lateral-movement","attack.t1021.002","attack.t1570","attack.execution","attack.t1569.002"],"path":"rules/windows/builtin/security/win_security_metasploit_or_impacket_smb_psexec_service_install.yml","techniques":["T1021.002","T1570","T1569.002"],"cves":[]},{"id":"72124974-a68b-4366-b990-d30e0b2a190d","title":"Metasploit SMB Authentication","author":"Chakib Gzenayi (@Chak092), Hosni Mribah","status":"test","level":"high","date":"2020-05-06","modified":"2024-01-25","description":"Alerts on Metasploit host's authentications on the domain.","references":["https://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/lib/rex/proto/smb/client.rb"],"logsource":{"product":"windows","service":"security"},"tags":["attack.lateral-movement","attack.t1021.002"],"path":"rules/windows/builtin/security/win_security_metasploit_authentication.yml","techniques":["T1021.002"],"cves":[]},{"id":"7707a579-e0d8-4886-a853-ce47e4575aaa","title":"Wmiprvse Wbemcomn DLL Hijack","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"high","date":"2020-10-12","modified":"2022-10-09","description":"Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\\Windows\\System32\\wbem\\` directory over the network and loading it for a WMI DLL Hijack scenario.","references":["https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.execution","attack.t1047","attack.lateral-movement","attack.t1021.002"],"path":"rules/windows/image_load/image_load_wmiprvse_wbemcomn_dll_hijack.yml","techniques":["T1047","T1021.002"],"cves":[]},{"id":"7e6237fe-3ddb-438f-9381-9bf9de5af8d0","title":"Windows Internet Hosted WebDav Share Mount Via Net.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-02-21","modified":"2023-07-25","description":"Detects when an internet hosted webdav share is mounted using the \"net.exe\" utility","references":["https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.lateral-movement","attack.t1021.002"],"path":"rules/windows/process_creation/proc_creation_win_net_use_mount_internet_share.yml","techniques":["T1021.002"],"cves":[]},{"id":"855bc8b5-2ae8-402e-a9ed-b889e6df1900","title":"Copy From Or To Admin Share Or Sysvol Folder","author":"Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali","status":"test","level":"medium","date":"2019-12-30","modified":"2025-10-22","description":"Detects a copy command or a copy utility execution to or from an Admin share or remote","references":["https://twitter.com/SBousseaden/status/1211636381086339073","https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view","https://www.elastic.co/guide/en/security/current/remote-file-copy-to-a-hidden-share.html","https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.lateral-movement","attack.collection","attack.exfiltration","attack.t1039","attack.t1048","attack.t1021.002"],"path":"rules/windows/process_creation/proc_creation_win_susp_copy_lateral_movement.yml","techniques":["T1039","T1048","T1021.002"],"cves":[]},{"id":"8d91f6e4-9f3b-4c21-ae41-2c5b7d9f7a12","title":"Unsigned or Unencrypted SMB Connection to Share Established","author":"Mohamed Abdelghani","status":"experimental","level":"medium","date":"2025-10-19","modified":null,"description":"Detects SMB server connections to shares without signing or encryption enabled.\nThis could indicate potential lateral movement activity using unsecured SMB shares.\n","references":["https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/overview-server-message-block-signing"],"logsource":{"product":"windows","service":"smbserver-connectivity"},"tags":["attack.lateral-movement","attack.t1021.002"],"path":"rules/windows/builtin/smbserver/connectivity/win_smbserver_connectivity_unsigned_and_unencrypted_share_connection.yml","techniques":["T1021.002"],"cves":[]},{"id":"b210394c-ba12-4f89-9117-44a2464b9511","title":"SMB Create Remote File Admin Share","author":"Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research)","status":"test","level":"high","date":"2020-08-06","modified":"2025-10-17","description":"Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).","references":["https://github.com/OTRF/ThreatHunter-Playbook/blob/f7a58156dbfc9b019f17f638b8c62d22e557d350/playbooks/WIN-201012004336.yaml","https://securitydatasets.com/notebooks/atomic/windows/lateral_movement/SDWIN-200806015757.html?highlight=create%20file"],"logsource":{"product":"windows","service":"security"},"tags":["attack.lateral-movement","attack.t1021.002"],"path":"rules/windows/builtin/security/win_security_smb_file_creation_admin_shares.yml","techniques":["T1021.002"],"cves":[]},{"id":"bae2865c-5565-470d-b505-9496c87d0c30","title":"SMB Spoolss Name Piped Usage","author":"OTR (Open Threat Research), @neu5ron","status":"test","level":"medium","date":"2018-11-28","modified":"2022-10-09","description":"Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.","references":["https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1","https://dirkjanm.io/a-different-way-of-abusing-zerologon/","https://twitter.com/_dirkjan/status/1309214379003588608"],"logsource":{"product":"zeek","service":"smb_files"},"tags":["attack.lateral-movement","attack.t1021.002"],"path":"rules/network/zeek/zeek_dce_rpc_smb_spoolss_named_pipe.yml","techniques":["T1021.002"],"cves":[]},{"id":"c39f0c81-7348-4965-ab27-2fde35a1b641","title":"DCOM InternetExplorer.Application Iertutil DLL Hijack - Security","author":"Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR)","status":"test","level":"high","date":"2020-10-12","modified":"2022-11-26","description":"Detects a threat actor creating a file named `iertutil.dll` in the `C:\\Program Files\\Internet Explorer\\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.","references":["https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html"],"logsource":{"product":"windows","service":"security"},"tags":["attack.lateral-movement","attack.t1021.002","attack.t1021.003"],"path":"rules/windows/builtin/security/win_security_dcom_iertutil_dll_hijack.yml","techniques":["T1021.002","T1021.003"],"cves":[]},{"id":"c462f537-a1e3-41a6-b5fc-b2c2cef9bf82","title":"Suspicious PsExec Execution","author":"Samir Bousseaden","status":"test","level":"high","date":"2019-04-03","modified":"2022-08-11","description":"detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one","references":["https://web.archive.org/web/20230329171218/https://blog.menasec.net/2019/02/threat-hunting-3-detecting-psexec.html"],"logsource":{"product":"windows","service":"security"},"tags":["attack.lateral-movement","attack.t1021.002"],"path":"rules/windows/builtin/security/win_security_susp_psexec.yml","techniques":["T1021.002"],"cves":[]},{"id":"c601f20d-570a-4cde-a7d6-e17f99cb8e7f","title":"Turla Group Lateral Movement","author":"Markus Neis","status":"test","level":"critical","date":"2017-11-07","modified":"2022-10-09","description":"Detects automated lateral movement by Turla group","references":["https://securelist.com/the-epic-turla-operation/65545/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.g0010","attack.execution","attack.t1059","attack.lateral-movement","attack.t1021.002","attack.discovery","attack.t1083","attack.t1135","detection.emerging-threats"],"path":"rules-emerging-threats/2014/TA/Turla/proc_creation_win_apt_turla_commands_critical.yml","techniques":["T1059","T1021.002","T1083","T1135"],"cves":[]},{"id":"d36f87ea-c403-44d2-aa79-1a0ac7c24456","title":"PUA - RemCom Default Named Pipe","author":"Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-08-07","modified":"2023-11-30","description":"Detects default RemCom pipe creation","references":["https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view","https://github.com/kavika13/RemCom"],"logsource":{"product":"windows","category":"pipe_created"},"tags":["attack.lateral-movement","attack.t1021.002","attack.execution","attack.t1569.002"],"path":"rules/windows/pipe_created/pipe_created_pua_remcom_default_pipe.yml","techniques":["T1021.002","T1569.002"],"cves":[]},{"id":"d4498716-1d52-438f-8084-4a603157d131","title":"Password Provided In Command Line Of Net.EXE","author":"Tim Shelton (HAWK.IO)","status":"test","level":"medium","date":"2021-12-09","modified":"2023-02-21","description":"Detects a when net.exe is called with a password in the command line","references":["Internal Research"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.persistence","attack.privilege-escalation","attack.lateral-movement","attack.stealth","attack.t1021.002","attack.t1078"],"path":"rules/windows/process_creation/proc_creation_win_net_use_password_plaintext.yml","techniques":["T1021.002","T1078"],"cves":[]},{"id":"d7a95147-145f-4678-b85d-d1ff4a3bb3f6","title":"CobaltStrike Service Installations - Security","author":"Florian Roth (Nextron Systems), Wojciech Lesicki","status":"test","level":"high","date":"2021-05-26","modified":"2022-11-27","description":"Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement","references":["https://www.sans.org/webcasts/119395","https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/","https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/"],"logsource":{"product":"windows","service":"security"},"tags":["attack.persistence","attack.execution","attack.privilege-escalation","attack.lateral-movement","attack.t1021.002","attack.t1543.003","attack.t1569.002"],"path":"rules/windows/builtin/security/win_security_cobaltstrike_service_installs.yml","techniques":["T1021.002","T1543.003","T1569.002"],"cves":[]},{"id":"efc21479-9e83-41da-8cf1-122e06ba8db3","title":"HackTool - NetExec File Indicators","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2026-04-08","modified":null,"description":"Detects file creation events indicating NetExec (nxc.exe) execution on the local machine.\nNetExec is a PyInstaller-bundled binary that extracts its embedded data files to a \"_MEI<random>\" directory\nunder the Temp folder upon execution. Files dropped under the \"\\nxc\\\" sub-directory of that\nextraction path are unique to NetExec and serve as reliable on-disk indicators of execution.\nNetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for\nActive Directory enumeration, credential harvesting, and remote code execution.\n","references":["https://github.com/Pennyw0rth/NetExec","https://www.netexec.wiki/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.lateral-movement","attack.discovery","attack.t1021.002","attack.t1059.005"],"path":"rules/windows/file/file_event/file_event_win_hktl_netexec_file_indicators.yml","techniques":["T1021.002","T1059.005"],"cves":[]},{"id":"f117933c-980c-4f78-b384-e3d838111165","title":"Windows Share Mount Via Net.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2023-02-02","modified":"2023-02-21","description":"Detects when a share is mounted using the \"net.exe\" utility","references":["https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.lateral-movement","attack.t1021.002"],"path":"rules/windows/process_creation/proc_creation_win_net_use_mount_share.yml","techniques":["T1021.002"],"cves":[]},{"id":"f1b3a22a-45e6-4004-afb5-4291f9c21166","title":"Suspicious PsExec Execution - Zeek","author":"Samir Bousseaden, @neu5ron, Tim Shelton","status":"test","level":"high","date":"2020-04-02","modified":"2022-12-27","description":"detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one","references":["https://web.archive.org/web/20230329171218/https://blog.menasec.net/2019/02/threat-hunting-3-detecting-psexec.html"],"logsource":{"product":"zeek","service":"smb_files"},"tags":["attack.lateral-movement","attack.t1021.002"],"path":"rules/network/zeek/zeek_smb_converted_win_susp_psexec.yml","techniques":["T1021.002"],"cves":[]},{"id":"f318b911-ea88-43f4-9281-0de23ede628e","title":"PUA - CSExec Default Named Pipe","author":"Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-08-07","modified":"2023-11-30","description":"Detects default CSExec pipe creation","references":["https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view","https://github.com/malcomvetter/CSExec"],"logsource":{"product":"windows","category":"pipe_created"},"tags":["attack.lateral-movement","attack.t1021.002","attack.execution","attack.t1569.002"],"path":"rules/windows/pipe_created/pipe_created_pua_csexec_default_pipe.yml","techniques":["T1021.002","T1569.002"],"cves":[]},{"id":"f354eba5-623b-450f-b073-0b5b2773b6aa","title":"Potential DCOM InternetExplorer.Application DLL Hijack - Image Load","author":"Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), wagga","status":"test","level":"critical","date":"2020-10-12","modified":"2022-12-18","description":"Detects potential DLL hijack of \"iertutil.dll\" found in the DCOM InternetExplorer.Application Class","references":["https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.lateral-movement","attack.t1021.002","attack.t1021.003"],"path":"rules/windows/image_load/image_load_iexplore_dcom_iertutil_dll_hijack.yml","techniques":["T1021.002","T1021.003"],"cves":[]},{"id":"f6c68d5f-e101-4b86-8c84-7d96851fd65c","title":"T1047 Wmiprvse Wbemcomn DLL Hijack","author":"Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR)","status":"test","level":"high","date":"2020-10-12","modified":"2022-02-24","description":"Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\\Windows\\System32\\wbem\\` directory over the network for a WMI DLL Hijack scenario.","references":["https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html"],"logsource":{"product":"windows","service":"security"},"tags":["attack.execution","attack.t1047","attack.lateral-movement","attack.t1021.002"],"path":"rules/windows/builtin/security/win_security_wmiprvse_wbemcomn_dll_hijack.yml","techniques":["T1047","T1021.002"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}