SMB insecure guest authentication activated (native)

Status: experimental
Severity: medium
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to enable insecure guest authentication in order to access a remote storage device (NAS) in order to perform some data exfiltration or lateral movement.

Known false positives

Admin activity (backup configuration)

MITRE ATT&CK coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools `T1689` Downgrade Attack
Lateral Movement	`T1021.002` Remote Services: SMB/Windows Admin Shares

Telemetry coverage

Provider	Record / event type
SMBClient	Event ID 31018: Guidance: An administrator has enabled AllowInsecureGuestAuth.

Rule body

title: SMB insecure guest authentication activated (native)
description: Detects scenarios where an attacker attempts to enable insecure guest authentication in order to access a remote storage device (NAS) in order to perform some data exfiltration or lateral movement.
references:
- https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-workstationservice-allowinsecureguestauth
tags:
- attack.lateral_movement
- attack.t1021.002 # Remote Services: SMB/Windows Admin Shares 
- attack.defense_evasion
- attack.t1562.010 # Impair Defenses: Downgrade Attack  
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    Channel: Microsoft-Windows-SMBClient/Security
    EventID: 31018
    RegName: AllowInsecureGuestAuth
    RegValue: 1
  condition: selection
falsepositives:
- Admin activity (backup configuration) 
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  Channel: Microsoft-Windows-SMBClient/Security
  EventID: 31018
  RegName: AllowInsecureGuestAuth
  RegValue: 1

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`RegName`	eq	`AllowInsecureGuestAuth`	`field:"RegName" kind:eq value:"AllowInsecureGuestAuth"`
`RegValue`	eq	`1`	`field:"RegValue" kind:eq value:"1"`