Detect Outbound SMB Traffic

Description

This search looks for outbound SMB connections made by hosts within your network to the Internet. SMB traffic is used for Windows file-sharing activity. One of the techniques often used by attackers involves retrieving the credential hash using an SMB request made to a compromised server controlled by the threat actor.

Content Mapping

This content is not mapped to any local saved search. Add mapping


Use Case

Security Monitoring

Category

Malware

Alert Volume

This search looks for outbound SMB connections made by hosts within your network to the Internet. SMB traffic is used for Windows file-sharing activity. One of the techniques often used by attackers involves retrieving the credential hash using an SMB request made to a compromised server controlled by the threat actor.

SPL Difficulty

None

Journey

Stage 1

MITRE ATT&CK Techniques

Application Layer Protocol

File Transfer Protocols

MITRE Threat Groups

APT41
Honeybee
Machete
SilverTerrier

Kill Chain Phases

Actions On Objectives
Command and Control

Data Sources

Network Communication

   Help

Detect Outbound SMB Traffic Help

In order to run this search effectively, we highly recommend that you leverage the Assets and Identity framework. It is important that you have good understanding of how your network segments are designed, and be able to distinguish internal from external address space. Add a category named internal to the CIDRs that host the company's assets in assets_by_cidr.csv lookup file, which is located in $SPLUNK_HOME/etc/apps/SA-IdentityManagement/lookups/. More information on updating this lookup can be found here: https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Addassetandidentitydata. This search also requires you to be ingesting your network traffic and populating the Network_Traffic data model

   Search

Open in Search