{"id":"72124974-a68b-4366-b990-d30e0b2a190d","title":"Metasploit SMB Authentication","description":"Alerts on Metasploit host's authentications on the domain.","author":"Chakib Gzenayi (@Chak092), Hosni Mribah","status":"test","level":"high","date":"2020-05-06","modified":"2024-01-25","tags":["attack.lateral-movement","attack.t1021.002"],"technique_ids":["T1021.002"],"logsource":{"product":"windows","service":"security"},"falsepositives":["Linux hostnames composed of 16 characters."],"references":["https://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/lib/rex/proto/smb/client.rb"],"source_path":"rules/windows/builtin/security/win_security_metasploit_authentication.yml","source_sha256":"889093e418a7aeb677462b7ba99950124470f18b40b37b789cd65bc35718c3b6","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_metasploit_authentication.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Metasploit SMB Authentication\nid: 72124974-a68b-4366-b990-d30e0b2a190d\nstatus: test\ndescription: Alerts on Metasploit host's authentications on the domain.\nreferences:\n    - https://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/lib/rex/proto/smb/client.rb\nauthor: Chakib Gzenayi (@Chak092), Hosni Mribah\ndate: 2020-05-06\nmodified: 2024-01-25\ntags:\n    - attack.lateral-movement\n    - attack.t1021.002\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection1:\n        EventID:\n            - 4625\n            - 4624\n        LogonType: 3\n        AuthenticationPackageName: 'NTLM'\n        WorkstationName|re: '^[A-Za-z0-9]{16}$'\n    selection2:\n        EventID: 4776\n        Workstation|re: '^[A-Za-z0-9]{16}$'\n    condition: 1 of selection*\nfalsepositives:\n    - Linux hostnames composed of 16 characters.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1021.002","id":"T1021.002","name":"SMB/Windows Admin Shares","page":"techniques/enterprise/T1021.002/"}],"data_path":"data/detection-rules/72124974-a68b-4366-b990-d30e0b2a190d.json","kind":"sigma"}