How does File Share Enumeration Work?
We are using a new network IOC tool.
It is identifying a lot of network traffic activity as possible malicious file share enumeration.
It appears to be normal activity but I don't know how to identify the root cause.
The help documents in the tool state (top line is the recommendation, the --- is a comment from me):
The host is accessing a large number of file shares as an end user attempts to find a particular file or directory
--- For each alert, the host is a user with elevated access right, for example a network admin or helpdesk tech.
Ask the user of the host whether she has any knowledge of accessing the listed file shares
--- They don't remember accessing any of the files listed.
Check the file server logs to see what files were accessed on the shares
---- I don't have access to do this but I don't see anything odd in the SIEM.
If the file share access continues and remains unexplained, determine which process on the internal host is accessing the file shares; in Windows systems, this can be done using a combination of netstat and tasklist commands
---- No access rights to do this
The PCAPS all show SMB2 errors - is this coincidental or could it be related?
The dashboard shows the alert as file share enumeration with the following information:
Host - an end user who is a helpdesk tech with elevated access rights
Source - A VLAN server
Targets - 14 devices that are a combo of desktops and servers
Enumerated files - a combo of user accounts (sometimes showing 2 of the same person, one for the AD name example - jsmith0, one for the exchange mail name jsmith) and service accounts.
How do I start to figure out where the file enumeration is stemming from?
Any guidance or recommendations would be appreciated. I did ask the vendor support for me info but I am still waiting for a reply.
Thank you.
It is identifying a lot of network traffic activity as possible malicious file share enumeration.
It appears to be normal activity but I don't know how to identify the root cause.
The help documents in the tool state (top line is the recommendation, the --- is a comment from me):
The host is accessing a large number of file shares as an end user attempts to find a particular file or directory
--- For each alert, the host is a user with elevated access right, for example a network admin or helpdesk tech.
Ask the user of the host whether she has any knowledge of accessing the listed file shares
--- They don't remember accessing any of the files listed.
Check the file server logs to see what files were accessed on the shares
---- I don't have access to do this but I don't see anything odd in the SIEM.
If the file share access continues and remains unexplained, determine which process on the internal host is accessing the file shares; in Windows systems, this can be done using a combination of netstat and tasklist commands
---- No access rights to do this
The PCAPS all show SMB2 errors - is this coincidental or could it be related?
The dashboard shows the alert as file share enumeration with the following information:
Host - an end user who is a helpdesk tech with elevated access rights
Source - A VLAN server
Targets - 14 devices that are a combo of desktops and servers
Enumerated files - a combo of user accounts (sometimes showing 2 of the same person, one for the AD name example - jsmith0, one for the exchange mail name jsmith) and service accounts.
How do I start to figure out where the file enumeration is stemming from?
Any guidance or recommendations would be appreciated. I did ask the vendor support for me info but I am still waiting for a reply.
Thank you.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.