rules/windows/builtin/security/win_admin_share_access.yml

title: Access to ADMIN$ Share
id: 098d7118-55bc-4912-a836-dc6483a8d150
status: test
description: Detects access to $ADMIN share
author: Florian Roth
date: 2017/03/04
modified: 2021/11/27
logsource:
  product: windows
  service: security
  definition: 'The advanced audit policy setting "Object Access > Audit File Share" must be configured for Success/Failure'
detection:
  selection:
    EventID: 5140
    ShareName: Admin$
  filter:
    SubjectUserName|endswith: '$'
  condition: selection and not filter
falsepositives:
  - Legitimate administrative activity
level: low
tags:
  - attack.lateral_movement
  - attack.t1021.002
Rule: Access to ADMIN$ share 2017-03-14 14:53:03 +01:00			`title: Access to ADMIN$ Share`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 098d7118-55bc-4912-a836-dc6483a8d150`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`status: test`
Rule: Fixed missing description 2018-06-08 11:38:27 +02:00			`description: Detects access to $ADMIN share`
Rule: Access to ADMIN$ share 2017-03-14 14:53:03 +01:00			`author: Florian Roth`
fix: fixed missing date fields in remaining files 2020-01-30 16:07:37 +01:00			`date: 2017/03/04`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`modified: 2021/11/27`
Rule: Access to ADMIN$ share 2017-03-14 14:53:03 +01:00			`logsource:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`product: windows`
			`service: security`
			`definition: 'The advanced audit policy setting "Object Access > Audit File Share" must be configured for Success/Failure'`
Rule: Access to ADMIN$ share 2017-03-14 14:53:03 +01:00			`detection:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`selection:`
			`EventID: 5140`
			`ShareName: Admin$`
			`filter:`
			`SubjectUserName\|endswith: '$'`
			`condition: selection and not filter`
fix: fixed missing date fields in remaining files 2020-01-30 16:07:37 +01:00			`falsepositives:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- Legitimate administrative activity`
Rule: Access to ADMIN$ share 2017-03-14 14:53:03 +01:00			`level: low`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`tags:`
			`- attack.lateral_movement`
			`- attack.t1021.002`