Linux network share discovery

BIOC Informational

Linux network share discovery

A Linux network share discovery command was executed.

Module:: Platform Analytics
Agent event type:: Process execution
Category:: Discovery
Status:: Enabled

ATT&CK tactics: Discovery (TA0007)

ATT&CK techniques: Network Share Discovery (T1135)

XQL query:

{"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$PROCESS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$PROCESS_START","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"OR":[{"OR":[{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"df","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"REGEX","RIGHT":".*((-aH)|(-a.*-H)|(-H.*-a)|(-Ha)).*","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"AND":[{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"smbutil","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"view","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"-g","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]},{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"showmount","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}}}],"original_query":null,"tables":["xdr_data"]}

Preventable: no