Situational AwarenessCAR-2014-03-001

SMB Write Request - NamedPipes

Hypothesis and description

An SMB write can be an indicator of lateral movement, especially when combined with other information such as execution of that written file. Named pipes are a subset of SMB write requests. Named pipes such as msftewds may not be alarming; however others, such as lsarpc, may.

Monitoring SMB write requests still creates some noise, particulary with named pipes. As a result, SMB is now split between writing named pipes and writing other files.

Platforms: Windows, Linux, macOS
Domain: Host, Network
Subtypes: Process, Netflow
Submitted: 2014-03-03
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1570 Lateral Tool Transfer	Lateral Movement	Low

1 technique. Links open MITRE ATT&CK.

T1570Lateral Tool Transfer

D3FEND techniques MITRE maps to this analytic

D3-IPCTA IPC Traffic Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

Pseudocode

Look for SMB network connections over port 445. Using a sensor that can decode protocol information, extract out the name of the pipe and potentially other information. This happens legitimately so certain pipes, such as spoolss should be appropriately white-listed. Certain pipes do correspond to adversary activity, including: * WINREG - Windows Remote Registry (CAR-2014-11-005) * ATSVC - Windows AT command (CAR-2015-04-001)

flow = search Flow:Message
smb_write = filter flow where (dest_port == "445" and protocol == "smb.write_pipe")
smb_write.pipe_name = smb_write.proto_info.pipe_name
output smb_write

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

View CAR-2014-03-001 on car.mitre.org