Detection rules › Kusto Query Language
Excessive share permissions
The query searches for event 5143, which is triggered when a share is created or changed and includes de share permissions. First it checks to see if this is a whitelisted share for the system (e.g. domaincontroller netlogon, printserver print$ etc.). The share permissions are then checked against 'allow' rule (A) for a number of well known overly permissive groups, like all users, guests, authenticated users etc. If these are found, an alert is raised so the share creation may be audited. Note: this rule only checks for changed permissions, to prevent repeat alerts if for example a comment is changed, but the permissions are not altered.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Discovery | T1135 Network Share Discovery |
| Collection | T1039 Data from Network Shared Drive |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Security-Auditing | 5143 | A network share object was modified. |
Stages and Predicates
Stage 1: source
SecurityEvent
Stage 2: where
macro "(TimeGenerated >= ago(timeframe))"
Stage 3: where
EventID eq "5143"
Stage 4: extend
Stage 5: extend
Stage 6: extend
Stage 7: project-away
Stage 8: where
macro "(tostring(OldSD) !~ tostring(NewSD))"
Stage 9: extend
Stage 10: join
Stage 11: where
not
macro "set_has_element(allowed_shares, share)"
Stage 12: project-away
Stage 13: extend
Stage 14: project-away
Stage 15: mv-expand
Stage 16: extend
Stage 17: extend
Stage 18: mv-expand
Stage 19: extend
Stage 20: where
and
not
DACLS is_null
DACLS starts_with "A;"
Stage 21: extend
Stage 22: extend
Stage 23: join
Stage 24: project-away
Stage 25: summarize
Stage 26: project-away
Exclusions
Top-level NOT(...) conjuncts — predicates this rule actively suppresses.
| Stage | Field | Kind | Excluded values |
|---|---|---|---|
| 1 | DACLS | is_null |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
DACLS | starts_with |
|
EventID | eq |
|