Techniques › T1135 › AN0514
AN0514 Analytic 0514
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>CLI tools (smbclient -L, smbmap, rpcclient, nmblookup) or custom scripts enumerate SMB shares on many internal hosts → corresponding SMB connections (445/139) captured by Zeek/Netflow within a short window.</p>
- Detects
- T1135 Network Share Discovery
- Part of
- DET0182 Behavior-chain detection for T1135 Network Share Discovery across Windows, Linux, and macOS
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve of smbclient, smbmap, rpcclient, nmblookup, crackmapexec smb | DC0032 Process Creation |
| NSM:Flow | connection: TCP connections to ports 139/445 to multiple hosts | DC0082 Network Connection Creation |
| NSM:Flow | smb_command: TreeConnectAndX to \\*\IPC$ / srvsvc or Trans2/NT_CREATE for listing shares | DC0021 OS API Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
BurstHostThreshold | Minimum unique hosts to flag (e.g., ≥5). |
TimeWindow | Correlation window between tool exec and SMB fan-out (default 10m). |
ApprovedInventoryHosts | IPs of vulnerability scanners or config mgmt systems. |