Execution of a file transferred over SMB

Identifies the execution of the binary file that was transferred over SMB. This pattern is characteristic of lateral movement via admin shares (C$, ADMIN$) followed by remote service creation or remote command execution, as used by PsExec-style tools, Impacket's psexec/smbexec/atexec, and commodity ransomware/backdoor deployment via SMB.

• Platform: Windows
• Severity: High
• MITRE Tactic: Lateral Movement
• MITRE Techniques: T1021, T1021.002

Back to all rules