MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1021.002SMB/Windows Admin Shares

Lateral Movement

View on MITRE ATT&CK →

1 Query

Remote File Copy via SMB Admin Share

mediumtestingDefender XDR

Microsoft Defender for Endpoint·DeviceNetworkEvents

DeviceNetworkEvents
| where Timestamp > ago(1d)
| where RemotePort == 445
| where ActionType == "ConnectionSuccess"
| where ipv4_is_private(RemoteIP)
| summarize TargetHosts = dcount(RemoteIP), HostList = make_set(RemoteIP, 20), ConnectionCount = count() by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, bin(Timestamp, 1h)
| where TargetHosts >= 3
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, TargetHosts, HostList, ConnectionCount
| sort by TargetHosts desc

FalconForce Team (adapted) · last tested 2025-03-01

Tuning notes

File servers and backup agents communicate to many hosts via SMB. Exclude known file server hostnames and backup service accounts.

+ Add another query for this technique →