kevmap

TechniquesT1135 › AN0515

AN0515 Analytic 0515

macOS · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Use of native/mac tools (sharing -l, smbutil view, mount_smbfs) or scripts to enumerate SMB shares across many hosts, followed by outbound SMB connections observed in PF/Zeek logs.</p>
Detects
T1135 Network Share Discovery
Part of
DET0182 Behavior-chain detection for T1135 Network Share Discovery across Windows, Linux, and macOS

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
macos:endpointsecurityES_EVENT_TYPE_NOTIFY_EXEC: Process execution of "sharing -l", "smbutil view", "mount_smbfs"DC0032 Process Creation
macos:unifiedlogCommand line contains smbutil view //, mount_smbfs //DC0064 Command Execution
NSM:FirewallOutbound connections to 139/445 to multiple destinationsDC0078 Network Traffic Flow
NSM:Flowconnection: SMB connections to multiple internal hostsDC0082 Network Connection Creation

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
BurstHostThresholdMinimum unique SMB destinations (e.g., ≥3–5 in smaller mac fleets).
TimeWindowCorrelation window between exec and SMB connections (default 10m).
AllowedMgmtToolsJamf/IT scripts legitimately running smbutil/mount_smbfs.