SMB File Copy to Multiple Devices (Microsoft Defender for Identity)
Detects instances where files are copied over SMB to multiple devices within a short timeframe, as identified by Microsoft Defender for Identity. This behavior may indicate lateral movement where an attacker distributes tools or payloads across systems to expand access and establish control.
CQL · Falcon Next-Gen SIEMCopy query
#Vendor = "microsoft"
| #event.module = "defender-identity"
| Vendor.category = "AdvancedHunting-IdentityDirectoryEvents"
| Vendor.properties.ActionType = "SMB file copy"
| groupBy([user.name, source.address], function=[count(as=file_copies),count(field=Vendor.properties.DestinationDeviceName, distinct=true, as=unique_destinations),collect(fields=Vendor.properties.DestinationDeviceName),collect(fields=[Vendor.properties.DeviceName,Vendor.properties.AdditionalFields.FileName]),min(@timestamp, as=start_time),max(@timestamp, as=end_time)])
| unique_destinations >= 1
| time_diff_min := (end_time - start_time) / 60000
| time_diff_min <= 30
| start_time_fmt := formatTime("%Y-%m-%d %H:%M:%S", field=start_time, timezone="UTC")
| end_time_fmt := formatTime("%Y-%m-%d %H:%M:%S", field=end_time, timezone="UTC")
| drop([start_time, end_time])
| sort([unique_destinations], order=desc)Detects instances where files are copied over SMB to multiple devices within a short timeframe, as identified by Microsoft Defender for Identity. This behavior may indicate lateral movement where an attacker distributes tools or payloads across systems to expand access and establish control.
smb_file_copy_to_multiple_devices_microsoft_defender_for_identity.yml
T1021.002
Kundan Kumar
Detection
Identity
Identity
2026-05-21
2026-05-21
