Detection rules › Splunk
Potential Exposed SMB_RDP Port - Windows (Windows Event Log)
Threat actors may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration. This use case detects successful network logon events (event 4624, Type 3) events with an external source IP, which indicates that logon events are being attempted from external IPs.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1190 Exploit Public-Facing Application |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4624 | An account was successfully logged on. |
Rule body yaml
id: '28886.52418'
title: Potential Exposed SMB_RDP Port - Windows
description: Threat actors may attempt to exploit a weakness in an Internet-facing
host or system to initially access a network. The weakness in the system can be
a software bug, a temporary glitch, or a misconfiguration. This use case detects
successful network logon events (event 4624, Type 3) events with an external source
IP, which indicates that logon events are being attempted from external IPs.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4624) OR
"EventID>4624<") Logon_Type=3 AND NOT src_ip IN(::1, 10.0.0.0/8, 127.0.0.0/8, 172.16.0.0/12,
192.168.0.0/16, 169.254.0.0/16, fc00::/7, fe80::/10) | iplocation src_ip prefix=geo
| where geoCountry!=""| table _time, host, user user, process_name, process_path,
src_country, src_dns, src_ip, geo_* | bin span=30s | stats values(*) as * by _time,
host, user '
techniques:
- initial-access:exploit public-facing application
technique_id:
- T1190
data_category:
- Windows event logs
references:
- https://detection.fyi/sigmahq/sigma/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login/
- https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4624) OR "EventID>4624<") Logon_Type=3 AND NOT src_ip IN(::1, 10.0.0.0/8, 127.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, fc00::/7, fe80::/10)
Stage 2: search
| iplocation src_ip prefix=geo
Stage 3: where
| where geoCountry!=""
Stage 4: table
| table _time, host, user user, process_name, process_path, src_country, src_dns, src_ip, geo_*
Stage 5: bucket
| bin span=30s
Stage 6: stats
| stats values(*) as * by _time, host, user
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
src_ip | in | 10.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, ::1, fc00::/7, fe80::/10 |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Logon_Type | eq |
|
geoCountry | ne |
|
prefix | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "EventID>4624<" |
| 2 | iplocation |
| 2 | src_ip |