ATT&CK T1135 - SMB Network Share Enumeration

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•7

This rule detects attempts to enumerate SMB network shares. It triggers when TCP traffic is directed to port 445 (SMB) on the home network, contains the SMB protocol signature, and specifically includes the string 'NetShareEnum' (case-insensitive). A threshold of 5 occurrences within 60 seconds from the same source IP is applied to reduce false positives.