Techniques › T1135 › AN0515
AN0515 Analytic 0515
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Use of native/mac tools (sharing -l, smbutil view, mount_smbfs) or scripts to enumerate SMB shares across many hosts, followed by outbound SMB connections observed in PF/Zeek logs.</p>
- Detects
- T1135 Network Share Discovery
- Part of
- DET0182 Behavior-chain detection for T1135 Network Share Discovery across Windows, Linux, and macOS
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:endpointsecurity | ES_EVENT_TYPE_NOTIFY_EXEC: Process execution of "sharing -l", "smbutil view", "mount_smbfs" | DC0032 Process Creation |
| macos:unifiedlog | Command line contains smbutil view //, mount_smbfs // | DC0064 Command Execution |
| NSM:Firewall | Outbound connections to 139/445 to multiple destinations | DC0078 Network Traffic Flow |
| NSM:Flow | connection: SMB connections to multiple internal hosts | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
BurstHostThreshold | Minimum unique SMB destinations (e.g., ≥3–5 in smaller mac fleets). |
TimeWindow | Correlation window between exec and SMB connections (default 10m). |
AllowedMgmtTools | Jamf/IT scripts legitimately running smbutil/mount_smbfs. |