Lion Cipher Lab
Detect lateral tool transfer from Detailed File Share auditing (Event 5145)
- SOC Analyst / Blue Team
- Intermediate
- ~75 min
- Free · no account required
Why it matters
When an intruder moves from one Windows machine to the next, they usually have to put a file on the new machine first: a tool, a script, a payload. The quickest way is to copy it over the network into one of the hidden administrative shares every Windows computer has -- ADMIN$ (the Windows folder) or C$ (the whole system drive) -- and then start it remotely as a service or through WMI. MITRE ATT&CK calls the copy Lateral Tool Transfer (T1570) and the share abuse SMB/Windows Admin Shares (T1021.002). The receiving machine can record that copy in its own Security log as Event 5145, with who did…
What you'll learn
- Reading Security Event 5145 (Audit Detailed File Share): ShareName, RelativeTargetName, AccessMask, IpAddress, SubjectUserName
- Decoding a 5145 AccessMask into file access rights and testing for the WriteData/AddFile and AppendData bits
- Explaining why IPC$ named-pipe opens and software deployment look exactly like a write to an admin share
- Detecting lateral tool transfer (MITRE ATT&CK T1570) over SMB/Windows Admin Shares (T1021.002)
- Correlating a share write with a 4697 service install or a services/WMI-launched 4688 on the same host
- Measuring precision and recall of five rules and pinning a trusted source to exactly what it is meant to do
Steps in this lab
- What lateral tool transfer looks like from the machine that receives it
- The event that carries the signal: 5145, and why it is not on by default in most places
- Decode the AccessMask -- the number that says 'this was a write'
- Generate a week of share activity with an intrusion in it
- Score five rules and read the numbers
- Read the alert list, not just the score
- Honest limits -- what 5145 cannot show you
- Optional: look at your own machine's share events (read-only)
- When to use this, and the better version