Analytics BIOC Low
✕

An uncommon executable was remotely written over SMB to an uncommon destination

An uncommon executable was remotely written over SMB to a destination, which was not involved in significant similar activity during last month.

Module:
Platform Analytics
Data source:
XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Lateral Movement (TA0008)
ATT&CK techniques: Remote Services: SMB/Windows Admin Shares (T1021.002)
Attacker's goals:

Transfer tools as part of lateral movement activity across the network.

Investigative actions:

Verify if the shared file is malicious. Investigate if the file was executed on the host. Check the remote SMB client for other suspicious activities.

Test period:
N/A (single event)
Deduplication:
1 Day
3 variations:
  • An uncommon executable was remotely written over SMB to a highly suspicious destination High (parent: Low)
  • An uncommon executable with SCR extension was remotely written over SMB to an uncommon destination Medium (parent: Low)
  • PsExec remote service component was remotely written over SMB to an uncommon destination Low