Detection rules › By event

Microsoft-Windows-SMBClient

Event	Rules
Event ID 30803	1
Event ID 30804	1
Event ID 30806	1
Event ID 31017	1
Event ID 31018	1

Event ID 30803

1 detection rules reference this event. View event page.

Sigma (1)

Potential CVE-2023-23397 Exploitation Attempt - SMB severity medium

Event ID 30804

1 detection rules reference this event. View event page.

Sigma (1)

Potential CVE-2023-23397 Exploitation Attempt - SMB severity medium

Event ID 30806

1 detection rules reference this event. View event page.

Sigma (1)

Potential CVE-2023-23397 Exploitation Attempt - SMB severity medium

Event ID 31017

1 detection rules reference this event. View event page.

Sigma (1)

Suspicious Rejected SMB Guest Logon From IP severity medium T1110, T1110.001

Event ID 31018

1 detection rules reference this event. View event page.

Sigma (1)

SMB insecure guest authentication activated (native) severity medium T1021, T1021.002, T1685, T1689