{"id":"78d5cab4-557e-454f-9fb9-a222bd0d5edc","title":"External Remote SMB Logon from Public IP","description":"Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.","author":"Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)","status":"test","level":"high","date":"2023-01-19","modified":"2024-03-11","tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.credential-access","attack.stealth","attack.t1133","attack.t1078","attack.t1110"],"technique_ids":["T1078","T1110","T1133"],"logsource":{"product":"windows","service":"security"},"falsepositives":["Legitimate or intentional inbound connections from public IP addresses on the SMB port."],"references":["https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html","https://twitter.com/Purp1eW0lf/status/1616144561965002752"],"source_path":"rules/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login.yml","source_sha256":"3cfdd25fc8490d0eb062a7782b653102c44e201e35d50b6cdb85f55847db9d59","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: External Remote SMB Logon from Public IP\nid: 78d5cab4-557e-454f-9fb9-a222bd0d5edc\nrelated:\n    - id: 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2\n      type: derived\nstatus: test\ndescription: Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.\nreferences:\n    - https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html\n    - https://twitter.com/Purp1eW0lf/status/1616144561965002752\nauthor: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)\ndate: 2023-01-19\nmodified: 2024-03-11\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.initial-access\n    - attack.credential-access\n    - attack.stealth\n    - attack.t1133\n    - attack.t1078\n    - attack.t1110\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4624\n        LogonType: 3\n    filter_main_local_ranges:\n        IpAddress|cidr:\n            - '::1/128'  # IPv6 loopback\n            - '10.0.0.0/8'\n            - '127.0.0.0/8'\n            - '172.16.0.0/12'\n            - '192.168.0.0/16'\n            - '169.254.0.0/16'\n            - 'fc00::/7'  # IPv6 private addresses\n            - 'fe80::/10'  # IPv6 link-local addresses\n    filter_main_empty:\n        IpAddress: '-'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Legitimate or intentional inbound connections from public IP addresses on the SMB port.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1078","id":"T1078","name":"Valid Accounts","page":"techniques/enterprise/T1078/"},{"key":"enterprise/T1110","id":"T1110","name":"Brute Force","page":"techniques/enterprise/T1110/"},{"key":"enterprise/T1133","id":"T1133","name":"External Remote Services","page":"techniques/enterprise/T1133/"}],"data_path":"data/detection-rules/78d5cab4-557e-454f-9fb9-a222bd0d5edc.json","kind":"sigma"}