I mainly use Linux and am not very familiar with Windows shares so my apologies if this question sounds noobish.
Say I'm attacking a Windows machine and host an SMB share from my Linux machine with malware in that share. I want to run the malware from that share on the victim machine.
Would AV try to quarantine/delete the malware when it's not on the local machine? If not, can running straight from a share circumvent some AV protections?
You are mixing two different concepts here: storage and execution.
When you use the SMB share, you are using the remote machine as the storage and mounting it locally. Real time protection will deny access to infected files, so you won't be even able to copy them to another folder. If configured to scan and take action on remote drives, your antivirus will try to quarantine infected files on the remote host.
If you are connected to a large remote share (a couple hundred terabytes), don't expect your antivirus to scan everything on that share: that would mean your machine downloading everything and scanning the files locally. Multiply that traffic by everyone connected to the share and the storage and the router would be pretty sad.
On the other hand, if you try to execute, copy or open anything from a remote share, your antivirus will step on and scan the file before giving you control.
When you say you want to execute malware on the remote machine, we are using the execution concept. Here your machine have nothing to do with anything. The execution will run on the remote machine, running software stored on the remote machine. Your antivirus will not notice anything, because it's entirely outside of its reach.
The filesystem is mounted locally on Windows. It is handled mostly just like an internal hard drive so I'd expect an AV to handle this the same as any other malware on a local drive. If in doubt, why not test it?
