Detection rules › Splunk
Potential SMB Activity from External IP - Windows (Windows Event Log)
Threat actors may scan for hosts with SMB ports exposed to the internet and attempt to access services. This rule detects external attempts to access SMB shares (Event IDs 5140 or 5145) following network logons (Event ID 4624, Logon Type 3) within a one minute period correlated by host and user, which may indicate a threat actor's initial access attempt via SMB.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1190 Exploit Public-Facing Application |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4624 | An account was successfully logged on. |
| Security-Auditing | Event ID 5140 | A network share object was accessed. |
| Security-Auditing | Event ID 5145 | A network share object was checked to see whether client can be granted desired access. |
Rule body yaml
id: '28893.52427'
title: Potential SMB Activity from External IP - Windows
description: Threat actors may scan for hosts with SMB ports exposed to the internet
and attempt to access services. This rule detects external attempts to access SMB
shares (Event IDs 5140 or 5145) following network logons (Event ID 4624, Logon Type
3) within a one minute period correlated by host and user, which may indicate a
threat actor's initial access attempt via SMB.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4624) OR
"EventID>4624<") Logon_Type=3 AND NOT src_ip IN(::1, 10.0.0.0/8, 127.0.0.0/8, 172.16.0.0/12,
192.168.0.0/16, 169.254.0.0/16, fc00::/7, fe80::/10) OR (TERM(EventCode=5140) OR
"EventID>5140<" OR TERM(EventCode=5145) OR "EventID>5145<") | iplocation src_ip
prefix=geo | where geoCountry!=""| table _time, host, user user, process_name, process_path,
src_country, src_dns, src_ip, geo_* | bin span=60s | stats values(*) as * by _time,
host, user | where match(signature_id, "5140|5145") and match(signature_id, "4624") '
techniques:
- initial-access:exploit public-facing application
technique_id:
- T1190
data_category:
- Windows event logs
references:
- https://detection.fyi/sigmahq/sigma/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login/
- https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4624) OR "EventID>4624<") Logon_Type=3 AND NOT src_ip IN(::1, 10.0.0.0/8, 127.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, fc00::/7, fe80::/10) OR (TERM(EventCode=5140) OR "EventID>5140<" OR TERM(EventCode=5145) OR "EventID>5145<")
Stage 2: search
| iplocation src_ip prefix=geo
Stage 3: where
| where geoCountry!=""
Stage 4: table
| table _time, host, user user, process_name, process_path, src_country, src_dns, src_ip, geo_*
Stage 5: bucket
| bin span=60s
Stage 6: stats
| stats values(*) as * by _time, host, user
Stage 7: where
| where match(signature_id, "5140|5145") and match(signature_id, "4624")
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Logon_Type | eq |
|
geoCountry | ne |
|
prefix | eq |
|
signature_id | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "EventID>4624<" |
| 1 | TERM |
| 1 | "EventID>5140<" |
| 1 | TERM |
| 1 | "EventID>5145<" |
| 2 | iplocation |
| 2 | src_ip |