A user established an SMB connection to multiple hosts

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	10 Minutes
Deduplication Period	1 Day
Required Data	XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules	Identity Analytics
ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Remote Services (T1021)
Severity	Informational

Description

A user established an SMB connection to multiple hosts. This might indicate an enumeration attempt by a compromised account.

Attacker's Goals

Adversaries can effectively map out and strategize their lateral movement within a network by leveraging diverse protocols for reconnaissance.

Investigative actions

• Verify if the host is a newly deployed server that consists of SMB services to multiple hosts.
• Look for the process that initiated this activity on the remote host.
• Check if the user is authorized to perform such activity.

Variations

A user established an SMB connection to multiple hosts for the first time

Synopsis

Field	Value
ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Remote Services (T1021)
Severity	Medium

Description

A user established an SMB connection to multiple hosts. This might indicate an enumeration attempt by a compromised account.

Attacker's Goals

Adversaries can effectively map out and strategize their lateral movement within a network by leveraging diverse protocols for reconnaissance.

Investigative actions

• Verify if the host is a newly deployed server that consists of SMB services to multiple hosts.
• Look for the process that initiated this activity on the remote host.
• Check if the user is authorized to perform such activity.

A user performed an abnormal SMB activity to multiple hosts

Synopsis

Field	Value
ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Remote Services (T1021)
Severity	Low

Description

A user established an SMB connection to multiple hosts. This might indicate an enumeration attempt by a compromised account.

Attacker's Goals

Adversaries can effectively map out and strategize their lateral movement within a network by leveraging diverse protocols for reconnaissance.

Investigative actions

• Verify if the host is a newly deployed server that consists of SMB services to multiple hosts.
• Look for the process that initiated this activity on the remote host.
• Check if the user is authorized to perform such activity.