Lateral Movement (TA0008)(opens in a new tab or window)
endpoint(opens in a new tab or window)
windows(opens in a new tab or window)
system(opens in a new tab or window)
m365_defender(opens in a new tab or window)
process where host.os.type == "windows" and event.type == "start" and
((process.name : "net.exe" or ?process.pe.original_file_name == "net.exe") or ((process.name : "net1.exe" or ?process.pe.original_file_name == "net1.exe") and
not process.parent.name : "net.exe")) and
process.args : "use" and
/* including hidden and webdav based online shares such as onedrive */
process.args : ("\\\\*\\*$*", "\\\\*@SSL\\*", "http*") and
/* excluding shares deletion operation */
not process.args : "/d*"
Install detection rules in Elastic Security
Detect Mounting Hidden or WebDav Remote Shares in the Elastic Security detection engine by installing this rule into your Elastic Stack.
To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).