Skip to main content
Tier One
High

SMB scanning and admin share access across the finance subnet

A-1053

00:00time on this alert, target 10 minutes

Back to queue

Alert details

Source
IDS
Detection rule
IDS-LATERAL-SMB-009
Affected user
m.okafor
Affected host
WKS-FINANCE-14
Source IP
10.20.14.61
First seen
2026-07-24T15:24:00Z

Why this fired, in plain English

One computer tried to reach the file-sharing port on dozens of other computers in a few minutes.

Suggested playbook

Lateral movement

  1. 1. Check whether the source is a known scanner in the asset database.
  2. 2. Measure the spread: how many hosts, over how long, on which ports?
  3. 3. Look for file writes to remote admin shares.
  4. 4. Check logon types: 3 (network), 9 (runas), 10 (RDP) tell you how credentials were used.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 4 events.

  1. Guided hint: this line matters

    ts=2026-07-24T15:20:02Z src="ids" event=port_scan src_ip=10.20.14.61 dest_subnet=10.20.14.0/24 dest_port=445 unique_hosts=63 duration_sec=41

    Port 445 is Windows file sharing. Touching 63 hosts in 41 seconds is scanning, not normal work.

  2. Guided hint: this line matters

    ts=2026-07-24T15:21:44Z host=WKS-FINANCE-14 EventID=4688 process_name="cmd.exe" parent_process="powershell.exe" user="m.okafor" cmdline="net use \\\\10.20.14.22\\C$ /user:northwind\\m.okafor"

    C$ is a hidden admin share. Mapping it on another workstation is how attackers move sideways.

  3. Guided hint: this line matters

    ts=2026-07-24T15:22:10Z host=WKS-FINANCE-14 EventID=4624 account="m.okafor" logon_type=9 process="runas.exe"

    Logon type 9 means running as a different identity — often stolen credentials being reused.

  4. Guided hint: this line matters

    ts=2026-07-24T15:23:31Z src="ids" event=smb_write src_ip=10.20.14.61 dest_ip=10.20.14.22 share="C$" filename="s.exe" bytes=241664

Related events

The order things happened in.

  1. 15:20Z

    63-host SMB sweep

  2. 15:21Z

    Admin share mapped on a peer workstation

  3. 15:23Z

    Executable written to the remote C$ share

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 4 lookups checked

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.