SMB over QUIC via Net.EXE Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

This rule detects the execution of 'net.exe' or 'net1.exe' with the command-line argument '/TRANSPORT:QUIC'. This combination indicates an attempt to mount Windows SMB shares over QUIC, which might be an unusual or unexpected activity in many enterprise environments. Adversaries could leverage this for lateral movement or data access.