detection.wiki

Detection rules › Splunk

Potential SMB Activity from External IP - Windows (Windows Event Log)

Group by
_time, host, user
Source
github.com/anvilogic-forge/armory

Threat actors may scan for hosts with SMB ports exposed to the internet and attempt to access services. This rule detects external attempts to access SMB shares (Event IDs 5140 or 5145) following network logons (Event ID 4624, Logon Type 3) within a one minute period correlated by host and user, which may indicate a threat actor's initial access attempt via SMB.

MITRE ATT&CK coverage

TacticTechniques
Initial Access

References

Telemetry coverage

ProviderRecord / event type
Security-AuditingEvent ID 4624: An account was successfully logged on.
Security-AuditingEvent ID 5140: A network share object was accessed.
Security-AuditingEvent ID 5145: A network share object was checked to see whether client can be granted desired access.

Rule body

id: '28893.52427'
title: Potential SMB Activity from External IP - Windows
description: Threat actors may scan for hosts with SMB ports exposed to the internet
  and attempt to access services. This rule detects external attempts to access SMB
  shares (Event IDs 5140 or 5145) following network logons (Event ID 4624, Logon Type
  3) within a one minute period correlated by host and user, which may indicate a
  threat actor's initial access attempt via SMB.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4624) OR
  "EventID>4624<") Logon_Type=3 AND NOT src_ip IN(::1, 10.0.0.0/8, 127.0.0.0/8, 172.16.0.0/12,
  192.168.0.0/16, 169.254.0.0/16, fc00::/7, fe80::/10) OR (TERM(EventCode=5140) OR
  "EventID>5140<" OR TERM(EventCode=5145) OR "EventID>5145<") | iplocation src_ip
  prefix=geo | where geoCountry!=""| table _time, host, user user, process_name, process_path,
  src_country, src_dns, src_ip, geo_* | bin span=60s | stats values(*) as * by _time,
  host, user | where match(signature_id, "5140|5145") and match(signature_id, "4624") '
techniques:
- initial-access:exploit public-facing application
technique_id: 
- T1190
data_category:
- Windows event logs
references:
- https://detection.fyi/sigmahq/sigma/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login/
- https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html

Stages and Predicates

Stage 1: search

`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4624) OR "EventID>4624<") Logon_Type=3 AND NOT src_ip IN(::1, 10.0.0.0/8, 127.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, fc00::/7, fe80::/10) OR (TERM(EventCode=5140) OR "EventID>5140<" OR TERM(EventCode=5145) OR "EventID>5145<")

Stage 2: search

| iplocation src_ip prefix=geo

Stage 3: where

| where geoCountry!=""

Stage 4: table

| table _time, host, user user, process_name, process_path, src_country, src_dns, src_ip, geo_*

Stage 5: bucket

| bin span=60s

Stage 6: stats

| stats values(*) as * by _time, host, user

Stage 7: where

| where match(signature_id, "5140|5145") and match(signature_id, "4624")

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
EventCodeeq
  • 4624 corpus 29 (splunk 13, kusto 11, chronicle 4, elastic 1)
  • 5140 corpus 8 (splunk 8)
  • 5145 corpus 23 (splunk 16, elastic 5, kusto 2)
field:"EventID" kind:eq
Logon_Typeeq
  • 3 corpus 41 (splunk 13, sigma 12, elastic 9, kusto 7)
field:"LogonType" kind:eq value:"3"
geoCountryne
  • ""
field:"geoCountry" kind:ne
prefixeq
  • geo corpus 2 (splunk 2)
field:"prefix" kind:eq value:"geo"
signature_idregex_match
  • "4624"
    • "5140
    • 5145"
field:"signature_id" kind:regex_match

Search terms

These SPL tokens match against raw event text.

StageTerm
1"EventID>4624<"
1"EventID>5140<"
1"EventID>5145<"
2iplocation
2src_ip