Detection rules › Sigma
Number of oustanding SMB requests increased
Detects scenarios where an attacker (specially Blackcat) increase the number of oufstanding requests to distribute malware payloads.
Known false positives
- system administrator activity or debugging
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule body
title: Number of oustanding SMB requests increased
description: Detects scenarios where an attacker (specially Blackcat) increase the number of oufstanding requests to distribute malware payloads.
references:
- https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc960259(v=technet.10)
tags:
- attack.persistence
- attack.t1021.002 # Remote Services: SMB/Windows Admin Shares
author: mdecrevoisier
status: experimental
logsource:
product: windows
category: process_creation
detection: # reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services \LanmanServer\Parameters /v MaxMpxCt /d 65535 /t REG_DWORD /f
selection:
NewProcessName|endswith: '\reg.exe'
CommandLine|contains|all:
- 'REG ADD'
- '\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters'
- 'MaxMpxCt'
condition: selection
falsepositives:
- system administrator activity or debugging
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
NewProcessName|endswith: '\reg.exe'
CommandLine|contains|all:
- 'REG ADD'
- '\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters'
- 'MaxMpxCt'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
NewProcessName | ends_with |
| field:"Image" kind:ends_with value:"\reg.exe" |