critical EQL Windows

Admin Share Write Followed by Execution

A file lands on ADMIN$ or C$ over SMB and something runs from that path minutes later. Either half is noisy; the sequence is the classic PsExec shape.

Rule source

admin-share-write-execute.eql

/* Admin Share Write Followed by Service or Process Execution
   T1021.002 - Remote Services: SMB/Windows Admin Shares
   The classic PsExec shape: a file lands on ADMIN$ or C$, then something runs
   from that path on the same host shortly afterwards. Either half alone is
   noisy; the sequence is not. */

sequence by host.id with maxspan=5m
  [ file where
      event.type == "creation" and
      file.path : ("?:\\Windows\\*", "?:\\Windows\\System32\\*") and
      process.name : ("System", "svchost.exe") and
      file.extension : ("exe", "dll", "bat", "ps1")
  ] as staged

  [ any where
      (
        process.parent.name : "services.exe" or
        event.code == "7045"
      ) and
      process.executable : "?:\\Windows\\*"
  ]

Required telemetry

Sysmon - Event ID 11 and 1, Windows System - Event ID 7045

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Software deployment tools that stage to admin shares then invoke a service
Patch orchestration during maintenance windows

Validation

PsExec and a SharpNoPSExec variant detonated against a lab member server

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.