jamf_protectinformationalTTP

SMB Mounted via Commandline

This detection functions by monitoring and report on various attempts to mount SMB shares via the command line.

Detection Query

$event.type == 1 AND ($event.process.path.lastPathComponent == "mount_smbfs" OR ($event.process.path.lastPathComponent == "open" AND (ANY $event.process.args BEGINSWITH "smb://")) OR ($event.process.path.lastPathComponent == "osascript" AND ((ANY $event.process.args == "osascript") AND (ANY $event.process.args CONTAINS "mount") AND (ANY $event.process.args CONTAINS "smb://"))))

Author

Jamf

Data Sources

Process EventsmacOS Endpoint Security

Platforms

macos

Tags

VisibilityLateralMovement

Raw Content

---
name: SmbMountedFromCommandline
uuid: c06ec9c1-69b0-499d-8e22-4d1f1299cbf4
longDescription: This detection functions by monitoring and report on various attempts to mount SMB shares via the command line.
level: 0
inputType: GPProcessEvent
tags:
snapshotFiles: []
filter: $event.type == 1 AND
  ($event.process.path.lastPathComponent == "mount_smbfs" OR
  ($event.process.path.lastPathComponent == "open" AND (ANY $event.process.args BEGINSWITH "smb://")) OR
  ($event.process.path.lastPathComponent == "osascript" AND ((ANY $event.process.args == "osascript") AND (ANY $event.process.args CONTAINS "mount") AND (ANY $event.process.args CONTAINS "smb://"))))
actions:
  - name: Log
context: []
categories:
  - Visibility
version: 1
severity: Informational
shortDescription: A SMB Mount operation occurred.
label: SMB Mounted via Commandline
remediation: null
MitreCategories:
  - LateralMovement