Detection rules › Sigma
SMB insecure guest authentication activated (native)
Detects scenarios where an attacker attempts to enable insecure guest authentication in order to access a remote storage device (NAS) in order to perform some data exfiltration or lateral movement.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1562.010 Impair Defenses: Downgrade Attack |
| Lateral Movement | T1021.002 Remote Services: SMB/Windows Admin Shares |
Rule body yaml
title: SMB insecure guest authentication activated (native)
description: Detects scenarios where an attacker attempts to enable insecure guest authentication in order to access a remote storage device (NAS) in order to perform some data exfiltration or lateral movement.
references:
- https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-workstationservice-allowinsecureguestauth
tags:
- attack.lateral_movement
- attack.t1021.002 # Remote Services: SMB/Windows Admin Shares
- attack.defense_evasion
- attack.t1562.010 # Impair Defenses: Downgrade Attack
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection:
Channel: Microsoft-Windows-SMBClient/Security
EventID: 31018
RegName: AllowInsecureGuestAuth
RegValue: 1
condition: selection
falsepositives:
- Admin activity (backup configuration)
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
Channel: Microsoft-Windows-SMBClient/Security
EventID: 31018
RegName: AllowInsecureGuestAuth
RegValue: 1
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.