Carbanak+FIN7
|
Step
|
ATT&CK Pattern
|
Detection Type |
Detection Note |
|
5.C.2
|
|
|
|
|
A Technique detection named "File: T1021.002 - Remote Services - SMBWindows Admin Shares" (Medium) was generated when a file was created in the Windows directory by a system process.
[1]
|
|
16.A.5
|
|
|
|
|
A Technique detection named "File: T1021.002 - Remote Services - SMB/Windows Admin Shares" (Medium) was generated when SMB session from 10.0.1.5 to 10.0.1.6 over TCP port 135 or 445 with admin shares accessed.
[1]
[2]
|
|
psexec.py connects to SMB shares on 10.0.0.4
-
Network Monitoring
-
Process Monitoring
[1]
psexec.py connects to SMB shares on 10.0.0.4
-
Process Monitoring
-
File Monitoring
[1]
SMB session from 10.0.1.5 to 10.0.1.6 over TCP port 135 or 445 with admin shares accessed
-
Process Monitoring
-
File Monitoring
[1]
SMB session from 10.0.1.5 to 10.0.1.6 over TCP port 135 or 445 with admin shares accessed
-
File Monitoring
-
Process Monitoring
[1]
[2]