AN0513
Analytic 0513
Windows
Process or script enumerates network shares via CLI (net view/net share, PowerShell Get-SmbShare/WMI) or OS APIs (NetShareEnum/ srvsvc.NetShareEnumAll RPC) → bursts of outbound SMB/RPC connections (445/139, \\host\IPC$ / srvsvc) to many hosts inside a short window → optional follow-on file listing or copy operations.
WinEventLog:Security
EventCode=4688
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=17
WinEventLog:PowerShell
EventCode=4103, 4104, 4105, 4106
etw:Microsoft-Windows-RPC
rpc_call: srvsvc.NetShareEnum / NetShareEnumAll from non-admin or unusual processes
[BurstHostThreshold]
Minimum number of unique destination hosts over SMB within TimeWindow to treat as scanning (e.g., ≥5).
[TimeWindow]
Correlation window between the discovery process start and SMB fan-out (default 10m).
[AllowedDiscoveryAccounts]
Service/admin accounts legitimately running inventory scripts.
[PipeNameAllowList]
Pipes (e.g., \PIPE\spoolss) normally accessed by management agents; exclude from alerts.
AN0514
Analytic 0514
Linux
CLI tools (smbclient -L, smbmap, rpcclient, nmblookup) or custom scripts enumerate SMB shares on many internal hosts → corresponding SMB connections (445/139) captured by Zeek/Netflow within a short window.
auditd:SYSCALL
execve of smbclient, smbmap, rpcclient, nmblookup, crackmapexec smb
NSM:Flow
connection: TCP connections to ports 139/445 to multiple hosts
NSM:Flow
smb_command: TreeConnectAndX to \\*\IPC$ / srvsvc or Trans2/NT_CREATE for listing shares
[BurstHostThreshold]
Minimum unique hosts to flag (e.g., ≥5).
[TimeWindow]
Correlation window between tool exec and SMB fan-out (default 10m).
[ApprovedInventoryHosts]
IPs of vulnerability scanners or config mgmt systems.
AN0515
Analytic 0515
macOS
Use of native/mac tools (sharing -l, smbutil view, mount_smbfs) or scripts to enumerate SMB shares across many hosts, followed by outbound SMB connections observed in PF/Zeek logs.
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_EXEC: Process execution of "sharing -l", "smbutil view", "mount_smbfs"
macos:unifiedlog
Command line contains smbutil view //, mount_smbfs //
NSM:Firewall
Outbound connections to 139/445 to multiple destinations
NSM:Flow
connection: SMB connections to multiple internal hosts
[BurstHostThreshold]
Minimum unique SMB destinations (e.g., ≥3–5 in smaller mac fleets).
[TimeWindow]
Correlation window between exec and SMB connections (default 10m).
[AllowedMgmtTools]
Jamf/IT scripts legitimately running smbutil/mount_smbfs.