Execution of a file transferred over SMB
Identifies the execution of the binary file that was transferred over SMB. This pattern is characteristic of lateral movement via admin shares (C$, ADMIN$) followed by remote service creation or remote command execution, as used by PsExec-style tools, Impacket's psexec/smbexec/atexec, and commodity ransomware/backdoor deployment via SMB.
- Plataforma: Windows
- Severidad: High
- Táctica MITRE: Movimiento lateral
- Técnicas MITRE: T1021, T1021.002