Corelight - Forced External Outbound SMB

Status: available
Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

'Detects SMB requests that originate internally and communicate with an external IP address.'

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1187` Forced Authentication

Rule body

id: 73f23aa2-5cc4-4507-940b-75c9092e9e01
name: Corelight - Forced External Outbound SMB
description: |
  'Detects SMB requests that originate internally and communicate with an external IP address.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: Corelight
    dataTypes:
      - Corelight_v2_conn
      - Corelight_v2_conn_red
      - corelight_conn
      - corelight_conn_red
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - CredentialAccess
relevantTechniques:
  - T1187
query: |
  union corelight_conn, corelight_conn_red
  | where local_orig == true
  | where local_resp == false
  | where history hasprefix 'Sh' and service hasprefix 'smb'
entityMappings:
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: id_orig_h
version: 2.1.0
kind: Scheduled

Stages and Predicates

union (2 sources)

Each leg below queries one source; the rule matches if any leg does. Sources: corelight_conn, corelight_conn_red

Leg 1: `corelight_conn`

Leg 2: `corelight_conn_red`

Applied to the combined result

| where local_orig == true | where local_resp == false | where history hasprefix 'Sh' and service hasprefix 'smb'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`history`	starts_with	`Sh`	`field:"history" kind:starts_with value:"Sh"`
`local_orig`	eq	`true`	`field:"local_orig" kind:eq value:"true"`
`local_resp`	eq	`false`	`field:"local_resp" kind:eq value:"false"`
`service`	starts_with	`smb`	`field:"service" kind:starts_with value:"smb"`