Gentlemen - SMB Propagation Artifacts (T1570)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•4

Detects the payload replicating itself to the C$ or ADMIN$ shares of remote hosts via SMB. This rule specifically looks for file creation events where the folder path matches a common internal IP address range followed by either 'ADMIN$' or 'C$'.