Detection rules › By catalog entry

Microsoft-Windows-SMBClient

Catalog entry	Rules
Event ID 30803	1
Event ID 30804	1
Event ID 30806	1
Event ID 31017	1
Event ID 31018	1

Event ID 30803

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Potential CVE-2023-23397 Exploitation Attempt - SMB severity medium

Event ID 30804

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Potential CVE-2023-23397 Exploitation Attempt - SMB severity medium

Event ID 30806

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Potential CVE-2023-23397 Exploitation Attempt - SMB severity medium

Event ID 31017

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

Suspicious Rejected SMB Guest Logon From IP severity medium T1110,T1110.001

Event ID 31018

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

SMB insecure guest authentication activated (native) severity medium T1021,T1021.002,T1685,T1689

Back to all Microsoft-Windows-SMBClient catalog entries