Situational AwarenessTTPCAR-2013-05-003

SMB Write Request

Hypothesis and description

As described in CAR-2013-01-003, SMB provides a means of remotely managing a file system. Adversaries often use SMB to move laterally to a host. SMB is commonly used to upload files. It may be used for staging in Exfiltration or as a Lateral Movement technique. Unlike SMB Reads, SMB Write requests typically require an additional level of access, resulting in less activity. Focusing on SMB Write activity narrows the field to find techniques that actively change remote hosts, instead of passively reading files.

Platforms: Windows, Linux, macOS
Domain: Host, Network
Subtypes: Network, Netflow, PCAP
Submitted: 2013-05-13
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1570 Lateral Tool Transfer	Lateral Movement	Moderate
T1021 Remote ServicesT1021.002	Lateral Movement	Moderate
T1078 Valid AccountsT1078.002, T1078.003	Stealth (formerly Defense Evasion)	Moderate

3 techniques, 6 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

D3FEND techniques MITRE maps to this analytic

D3-IPCTA IPC Traffic Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

Pseudocode

flow = search Flow:Message
smb_write = filter flow where (dest_port == "445" and protocol == "smb.write")
smb_write.file_name = smb_write.proto_info.file_name
output smb_write

Across MITRE's defensive frameworks

Linked through the 3 ATT&CK techniques above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

9 more in the full list

View CAR-2013-05-003 on car.mitre.org