AN1145
Analytic 1145
Windows
Monitoring of file access to network shares (e.g., C$, Admin$) followed by unusual read or copy operations by processes not typically associated with such activity (e.g., PowerShell, certutil).
WinEventLog:Security
EventCode=5145
WinEventLog:Sysmon
EventCode=11
[ShareName]
Organizations may use custom share paths outside of default C$, Admin$, etc.
[ProcessName]
Common toolsets vary; defenders should tailor to unusual processes for their environment.
[TimeWindow]
Time of day and access duration may need to be tuned to reduce false positives.
AN1146
Analytic 1146
Linux
Unusual access or copying of files from mounted network drives (e.g., NFS, CIFS/SMB) by user shells or scripts followed by large data transfer.
auditd:SYSCALL
open,read
linux:syslog
mount/umount or file copy logs
[MountPoint]
Organization-specific share mount paths may vary (/mnt/share1, /srv/data etc.)
[UID]
May need to scope to service accounts or user ID patterns specific to enterprise policy.
AN1147
Analytic 1147
macOS
Detection of file access from mounted SMB shares followed by copy or exfil commands from Terminal or script interpreter processes.
macos:unifiedlog
filesystem and process events
fs:fsusage
open/read/mount operations
[ProcessPath]
Script interpreters may vary (e.g., zsh, bash, python, osascript).
[SharePath]
Network drive mount points may differ across enterprises.