Executable or script written to a user-facing network share

Siemphony@siemphonylowT1080unverified

Matches the file-drop half of AN1298 on the server side: a detailed file-share access check in which the requested access includes write or append and the target file inside the share carries an executable, script or shortcut extension. The rule is written in the native Security 5145 vocabulary (`ShareName`, `RelativeTargetName`, `AccessList`), not the Sysmon-shaped `file_event` vocabulary the brief also offers, because Sysmon EventID 11 records the path as the writing host sees it — a drive letter on the client, a local path on the file server — so a share-path gate on `TargetFilename` is unreliable in both places; using that feed instead would need a field mapping first. Administrative, IPC and printer-driver shares are excluded so the rule stays on shares users actually browse, and the logon-script shares are excluded because tampering there is T1037. Two honest limits: 5145 records the access the client *requested* at the share check, not a completed write, and the extension list only sees whole files dropped in — a macro appended to an existing .xlsm on the share produces the same 5145 record as any other write. The access check is written twice over because collectors disagree on the value: the raw event data carries the unresolved message-table codes `%%4417`/`%%4418`, while any collector that resolves message strings writes the same access as `WriteData (or AddFile)` / `AppendData (or AddSubdirectory)` — matching only the codes would silently miss every estate on the resolved form. Confirm which form your pipeline stores, and that it names the field `AccessList` at all, before trusting the result. The MITRE `SharedPathPrefix` knob is deliberately left unpopulated here so the rule is not silently scoped to one site's share names; adding a positive `ShareName` gate is the first tuning step. Security 5145 requires the *Audit Detailed File Share* subcategory, which is off by default and absent from the Microsoft and CIS baselines — with it off this rule returns zero rows, and zero rows here means blind, not quiet. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0471, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

SecurityEvent| where ((EventID == 5145 and (AccessList contains "%%4417" or AccessList contains "%%4418" or AccessList contains "WriteData" or AccessList contains "AppendData") and (RelativeTargetName endswith ".lnk" or RelativeTargetName endswith ".url" or RelativeTargetName endswith ".exe" or RelativeTargetName endswith ".dll" or RelativeTargetName endswith ".scr" or RelativeTargetName endswith ".msi" or RelativeTargetName endswith ".bat" or RelativeTargetName endswith ".cmd" or RelativeTargetName endswith ".ps1" or RelativeTargetName endswith ".vbs" or RelativeTargetName endswith ".vbe" or RelativeTargetName endswith ".js" or RelativeTargetName endswith ".jse" or RelativeTargetName endswith ".wsf" or RelativeTargetName endswith ".hta" or RelativeTargetName endswith ".jar" or RelativeTargetName endswith ".chm" or RelativeTargetName endswith ".iso")) and not ((ShareName endswith "\\ADMIN$" or ShareName endswith "\\IPC$" or ShareName endswith "\\C$" or ShareName endswith "\\D$" or ShareName endswith "\\E$" or ShareName endswith "\\print$" or ShareName endswith "\\NETLOGON" or ShareName endswith "\\SYSVOL")))

Splunk · SPL

Run this as a search.

index=* ((EventID="5145" AND (AccessList="*%%4417*" OR AccessList="*%%4418*" OR AccessList="*WriteData*" OR AccessList="*AppendData*") AND (RelativeTargetName="*.lnk" OR RelativeTargetName="*.url" OR RelativeTargetName="*.exe" OR RelativeTargetName="*.dll" OR RelativeTargetName="*.scr" OR RelativeTargetName="*.msi" OR RelativeTargetName="*.bat" OR RelativeTargetName="*.cmd" OR RelativeTargetName="*.ps1" OR RelativeTargetName="*.vbs" OR RelativeTargetName="*.vbe" OR RelativeTargetName="*.js" OR RelativeTargetName="*.jse" OR RelativeTargetName="*.wsf" OR RelativeTargetName="*.hta" OR RelativeTargetName="*.jar" OR RelativeTargetName="*.chm" OR RelativeTargetName="*.iso")) AND NOT ((ShareName="*\\ADMIN$" OR ShareName="*\\IPC$" OR ShareName="*\\C$" OR ShareName="*\\D$" OR ShareName="*\\E$" OR ShareName="*\\print$" OR ShareName="*\\NETLOGON" OR ShareName="*\\SYSVOL")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((event.code == 5145 AND (TO_LOWER(AccessList) LIKE "*%%4417*" OR TO_LOWER(AccessList) LIKE "*%%4418*" OR TO_LOWER(AccessList) LIKE "*writedata*" OR TO_LOWER(AccessList) LIKE "*appenddata*") AND (TO_LOWER(RelativeTargetName) LIKE "*.lnk" OR TO_LOWER(RelativeTargetName) LIKE "*.url" OR TO_LOWER(RelativeTargetName) LIKE "*.exe" OR TO_LOWER(RelativeTargetName) LIKE "*.dll" OR TO_LOWER(RelativeTargetName) LIKE "*.scr" OR TO_LOWER(RelativeTargetName) LIKE "*.msi" OR TO_LOWER(RelativeTargetName) LIKE "*.bat" OR TO_LOWER(RelativeTargetName) LIKE "*.cmd" OR TO_LOWER(RelativeTargetName) LIKE "*.ps1" OR TO_LOWER(RelativeTargetName) LIKE "*.vbs" OR TO_LOWER(RelativeTargetName) LIKE "*.vbe" OR TO_LOWER(RelativeTargetName) LIKE "*.js" OR TO_LOWER(RelativeTargetName) LIKE "*.jse" OR TO_LOWER(RelativeTargetName) LIKE "*.wsf" OR TO_LOWER(RelativeTargetName) LIKE "*.hta" OR TO_LOWER(RelativeTargetName) LIKE "*.jar" OR TO_LOWER(RelativeTargetName) LIKE "*.chm" OR TO_LOWER(RelativeTargetName) LIKE "*.iso")) AND NOT ((TO_LOWER(ShareName) LIKE "*\\\\admin$" OR TO_LOWER(ShareName) LIKE "*\\\\ipc$" OR TO_LOWER(ShareName) LIKE "*\\\\c$" OR TO_LOWER(ShareName) LIKE "*\\\\d$" OR TO_LOWER(ShareName) LIKE "*\\\\e$" OR TO_LOWER(ShareName) LIKE "*\\\\print$" OR TO_LOWER(ShareName) LIKE "*\\\\netlogon" OR TO_LOWER(ShareName) LIKE "*\\\\sysvol")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^5145$</field>    <field name="AccessList" type="pcre2">(?i)(%%4417|%%4418|WriteData|AppendData)</field>    <field name="RelativeTargetName" type="pcre2">(?i)(\.lnk$|\.url$|\.exe$|\.dll$|\.scr$|\.msi$|\.bat$|\.cmd$|\.ps1$|\.vbs$|\.vbe$|\.js$|\.jse$|\.wsf$|\.hta$|\.jar$|\.chm$|\.iso$)</field>    <field name="ShareName" negate="yes" type="pcre2">(?i)(\\ADMIN\$$|\\IPC\$$|\\C\$$|\\D\$$|\\E\$$|\\print\$$|\\NETLOGON$|\\SYSVOL$)</field>    <description>Executable or script written to a user-facing network share</description>    <mitre>      <id>T1080</id>    </mitre>  </rule></group>

At a glance

Logsource: security / windows
Level: low
Category: lateral_movement_remote_exec
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 4c5896a5-c3e9-42e6-95e6-7813bc5ba90b

ATT&CKT1080

T1080Taint Shared Content

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonlateral movement remote exec

lateral movement remote execAI draft — unreviewed

01 · What this rule detects

AN1298 describes file drops into shared directories — a malicious .lnk, .exe or .vbs — followed by user execution. This rule implements only the drop, and only as the file server sees it: a Security 5145 detailed file-share access check where the client requested write or append access to a file whose name ends in an executable, script or shortcut extension, on a share that is not administrative. Be clear what a hit is not. 5145 records the access a client requested at the share permission check, not a completed write. And the extension gate sees only whole files arriving — a macro appended to an .xlsm already on the share produces the same record as any other write.

02 · Telemetry you need

product: windows / service: security, copied from AN1298's second log source. EventID 5145 needs the Audit Detailed File Share subcategory, which is off by default and absent from both the Microsoft and CIS baselines. With it off the rule returns zero rows, and zero rows here means blind, not quiet.
The brief also offers Sysmon EventID 11 as file_event. It was not used: Sysmon records the path as the writing host sees it — a drive letter on the client, a local path on the server — so a share gate on TargetFilename is unreliable at both ends.

03 · How the logic works

selection ANDs three conditions. EventID: 5145 pins the event. AccessList|contains lists four alternatives, and the reason there are four is a collector disagreement worth knowing: raw EVTX data stores the requested access as the unresolved message-table codes %%4417 and %%4418, while any pipeline that performs message-string resolution stores WriteData (or AddFile) and AppendData (or AddSubdirectory). Matching only the codes would silently miss every estate on the resolved form. Confirm which yours stores — and that it names the field AccessList at all. RelativeTargetName|endswith is the extension gate: binaries (.exe, .dll, .scr, .msi), scripts (.bat, .cmd, .ps1, .vbs, .js, .hta, .wsf), containers (.jar, .iso, .chm) and the two shortcut types (.lnk, .url). MITRE names the knob ExecutableExtensions; the seventeen values in it are the pipeline's own. filter_infrastructure_shares subtracts on ShareName|endswith: ADMIN$, IPC$, the drive-letter admin shares, print$, plus NETLOGON and SYSVOL. Those last two are a judgement call the reviewer disputed — SYSVOL is where a planted executable has domain-wide blast radius, and only tampering with an existing logon script is T1037.003. Consider dropping them.

04 · Common false positives

Loudest by a wide margin: a software distribution share, where packaging automation copies .exe, .msi and .dll on every release. Behind it, folder redirection and roaming profiles put every user's Start Menu and Desktop on a share, so Windows writes .lnk there continuously with no user intent involved.
Then the structural one. Because 5145 logs a requested access, Explorer copying files off a share, Office opening a document, and anything opening with MAXIMUM_ALLOWED or GENERIC_ALL all set the write bits without a byte being written. Much of the volume is people merely reading an executable — the opposite of the drop this rule is filed for. level: low is calibrated to that.

05 · Detection maturity

tier_1: , and it stays there until it has been run against real data. It is machine-derived from a MITRE scaffold containing no query logic and has never touched a log line. Tracing it on paper says a dropped .exe lands in the selection — that is analysis, not verification.
tier_2: run read-only for a fortnight, rank by `ShareName` and `SubjectUserName`, and turn the top of that list into the positive share gate.
tier_3: ** join the write to the execution half of AN1298 — a process later launched from that same share path — so an alert means tainting rather than a file copy.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Populate MITRE's SharedPathPrefix knob as a positive ShareName gate over
Exclude distribution and build service accounts on SubjectUserName; they are
Treat a lone .lnk hit as insufficient: the directory-share pivot also needs the

Declared by the author

Software distribution shares, where packaging automation and desktop administrators copy .exe, .msi and .dll into the share on every application release. On any estate that deploys software from a file share this is the highest-volume match by a wide margin, and it is what MITRE's SharedPathPrefix knob exists to scope away.
Folder redirection and roaming profiles, which put every user's Start Menu, Desktop and Recent items on a share — so ordinary use of Windows writes .lnk files there continuously, with no user intent involved at all.
Build and release servers publishing compiled artefacts to a shared output directory, which produces bursts of .exe, .dll and .jar writes from a service account whenever a pipeline finishes.
Users saving a shortcut or a small helper script into a team share, for instance a .lnk pointing at a frequently used subfolder or a .bat that maps a drive — benign, common, and indistinguishable from the shortcut-planting variant of this technique at the file-write event alone.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1080, evaluated against their — events.

Share this rule

/u/siemphony/4c5896a5-c3e9-42e6-95e6-7813bc5ba90b

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Executable or script written to a user-facing network share

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it