Rare file transfer over SMB protocol

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	2 Days
Required Data	XDR Agent
Detector Tags	NDR Lateral Movement Analytics
ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Remote Services (T1021)
Severity	Low

Description

The endpoint performed an abnormal file transfer over SMB to a remote host.

Attacker's Goals

• Attackers may attempt to gain persistence or move laterally over the network by dropping executable files and scripts on remote hosts using the SMB protocol.

Investigative actions

• Inspect the file that was transferred to the remote host.
• Verify that this isn't IT activity.