Detect network share enumeration from the command line

Siemphony@siemphonylowT1135unverified

Matches command lines that enumerate SMB shares — the net view / net share CLI, the PowerShell Get-SmbShare cmdlet, the Win32_Share WMI class and the NetShareEnum API name — which is the opening move of AN0513. Everything that makes that analytic high-fidelity is a correlation: a burst of SMB or RPC connections to at least BurstHostThreshold unique destinations inside TimeWindow, optionally followed by file listing. Sigma can neither count distinct destinations nor join across a window, so this rule fires on the single enumeration command and is levelled low to say so. Matching is done entirely on CommandLine, keeping the cmd, PowerShell and WMI variants in one field so every backend renders the rule as a single alternation. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0182, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "net view" or ProcessCommandLine contains "net.exe view" or ProcessCommandLine contains "net1 view" or ProcessCommandLine contains "net1.exe view" or ProcessCommandLine contains "net share" or ProcessCommandLine contains "net.exe share" or ProcessCommandLine contains "net1 share" or ProcessCommandLine contains "net1.exe share" or ProcessCommandLine contains "Get-SmbShare" or ProcessCommandLine contains "Win32_Share" or ProcessCommandLine contains "NetShareEnum")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*net view*" OR CommandLine="*net.exe view*" OR CommandLine="*net1 view*" OR CommandLine="*net1.exe view*" OR CommandLine="*net share*" OR CommandLine="*net.exe share*" OR CommandLine="*net1 share*" OR CommandLine="*net1.exe share*" OR CommandLine="*Get-SmbShare*" OR CommandLine="*Win32_Share*" OR CommandLine="*NetShareEnum*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*net view*" OR TO_LOWER(process.command_line) LIKE "*net.exe view*" OR TO_LOWER(process.command_line) LIKE "*net1 view*" OR TO_LOWER(process.command_line) LIKE "*net1.exe view*" OR TO_LOWER(process.command_line) LIKE "*net share*" OR TO_LOWER(process.command_line) LIKE "*net.exe share*" OR TO_LOWER(process.command_line) LIKE "*net1 share*" OR TO_LOWER(process.command_line) LIKE "*net1.exe share*" OR TO_LOWER(process.command_line) LIKE "*get-smbshare*" OR TO_LOWER(process.command_line) LIKE "*win32_share*" OR TO_LOWER(process.command_line) LIKE "*netshareenum*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(net view|net\.exe view|net1 view|net1\.exe view|net share|net\.exe share|net1 share|net1\.exe share|Get-SmbShare|Win32_Share|NetShareEnum)</field>    <description>Detect network share enumeration from the command line</description>    <mitre>      <id>T1135</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: network_service_discovery
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 6c403e52-678d-4698-bc7d-403380607270

ATT&CKT1135

T1135Network Share Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonnetwork service discovery

network service discoveryAI draft — unreviewed

01 · What this rule detects

A command line that enumerates SMB shares: the net view / net share CLI, the Get-SmbShare cmdlet, the Win32_Share WMI class, and the NetShareEnum API name. That is the opening move of MITRE's AN0513 — and only the opening move. Everything that makes AN0513 high-fidelity is a correlation: a burst of SMB or RPC connections to at least BurstHostThreshold unique destinations inside TimeWindow. Sigma can neither count distinct destinations nor join across a window. One net view is not an incident; five hundred in ten minutes is. This rule sees the one, which is why it is levelled low — that level is the author telling you what the rule is, not hedging.

02 · Telemetry you need

Sysmon EventID 1, or Security 4688 with Audit Process Creation and
For three of the eleven terms, you actually need a different log source

03 · How the logic works

One selection, eleven substrings, all on CommandLine:

net1.exe is listed because net.exe re-launches itself as net1.exe in some contexts. Keeping everything on one field means all four backends render this as a single alternation, with no refusals. The teaching moment: `net view` has no `Image` anchor and is an unanchored substring. The Splunk render is CommandLine="*net view*". Nothing requires those eight characters to be a command — they only have to appear somewhere in the string. A path like "C:\Program Files\Subnet Viewer\scan.exe" lowercases to something containing net view. A wrapper echoing its own instructions, cmd /c echo running net share >> audit.log, matches without enumerating anything. The rule's third false positive names this, which is the right handling. But the missing anchor is defensible, and that is the more interesting lesson. Adding Image|endswith: '\net.exe' would kill the Get-SmbShare, Win32_Share and NetShareEnum arms outright — those never run under net.exe. A field anchor is a trade, not a free tightening: it buys precision on some arms by deleting others. If you tighten later, carry Image as an enrichment field for triage rather than as a filter. Three of the eleven terms are mostly invisible in this log source. Get-SmbShare, Win32_Share and NetShareEnum reach CommandLine only when passed as an argument (powershell.exe -c Get-SmbShare). Run inside a .ps1, inside an already-open console, or via -EncodedCommand, there is no process creation event carrying the string — process_creation records the command line of the process, not what the interpreter subsequently executes. The brief offers product: windows / service: powershell (4103/4104) for exactly this, and the rule does not use it. And the literals break on whitespace. net view \\host with two spaces, net vi^ew using cmd's caret escaping (which survives into the logged command line), and net.exe "view" all execute normally and match nothing. wmic share get — the classic non-PowerShell enumeration — is simply absent.

04 · Common false positives

Logon scripts and helpdesk work: net view \\fileserver before a net use
Asset-inventory, backup and configuration-management agents calling
Backup and DR agents and DFS-R namespace health scripts enumerating shares on
Substring collisions, per above.

05 · Detection maturity

tier_1: .* UNVERIFIED — derived from MITRE ATT&CK DET0182 and never executed against a log line. As an alert* on a workstation fleet this is not deployable. As a hunt feed or low-severity enrichment on a server estate, net view/net share volume is low enough to be workable — which is what level: low claims.
tier_2: means measuring that volume and finding out whether the substring collisions are real in your data or theoretical.
tier_3: means the correlation: this command joined to a Sysmon EventID 3 fan-out across ≥5 unique destinations inside ten minutes. Until then, remember that an operator who types two spaces defeats every term in the list.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Apply MITRE's AllowedDiscoveryAccounts knob on User, not on the command.
BurstHostThreshold and TimeWindow are the knobs that actually separate an
PipeNameAllowList needs Sysmon EventID 17, a log source this rule does not
Add a wmic + share arm; author a companion rule on the PowerShell

Declared by the author

Logon scripts and helpdesk troubleshooting. net view \fileserver before a net use drive mapping is ordinary administration, and MITRE's AllowedDiscoveryAccounts knob exists for the service and admin accounts that run it on a schedule — filter on User rather than on the command.
Asset-inventory, backup and configuration-management agents that call Get-SmbShare or the Win32_Share WMI class across the estate. At the single- event level these are indistinguishable from an operator enumerating shares; only the BurstHostThreshold that Sigma cannot express separates them.
Substring collisions. The rule anchors on CommandLine with no Image constraint, so any command line containing \"net view\" inside a longer token — a path or a product name ending in \"net\" followed by \"view\" — matches.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Not verified

Security Datasets — Network share discovery
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1135, evaluated against their process_creation events.

Share this rule

/u/siemphony/6c403e52-678d-4698-bc7d-403380607270

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect network share enumeration from the command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it