{"id":"8d91f6e4-9f3b-4c21-ae41-2c5b7d9f7a12","title":"Unsigned or Unencrypted SMB Connection to Share Established","description":"Detects SMB server connections to shares without signing or encryption enabled.\nThis could indicate potential lateral movement activity using unsecured SMB shares.\n","author":"Mohamed Abdelghani","status":"experimental","level":"medium","date":"2025-10-19","modified":"","tags":["attack.lateral-movement","attack.t1021.002"],"technique_ids":["T1021.002"],"logsource":{"product":"windows","service":"smbserver-connectivity"},"falsepositives":["Connections from local or private IP addresses to SMB shares without signing or encryption enabled for older systems or misconfigured environments. Apply additional tuning as needed."],"references":["https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/overview-server-message-block-signing"],"source_path":"rules/windows/builtin/smbserver/connectivity/win_smbserver_connectivity_unsigned_and_unencrypted_share_connection.yml","source_sha256":"a65cbd65cb098ad020ce3270a0858de0021d1dd6dafc4c62a18ce39287f09324","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/smbserver/connectivity/win_smbserver_connectivity_unsigned_and_unencrypted_share_connection.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Unsigned or Unencrypted SMB Connection to Share Established\nid: 8d91f6e4-9f3b-4c21-ae41-2c5b7d9f7a12\nstatus: experimental\ndescription: |\n    Detects SMB server connections to shares without signing or encryption enabled.\n    This could indicate potential lateral movement activity using unsecured SMB shares.\nauthor: Mohamed Abdelghani\ndate: 2025-10-19\nreferences:\n    - https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/overview-server-message-block-signing\ntags:\n    - attack.lateral-movement\n    - attack.t1021.002\nlogsource:\n    product: windows\n    service: smbserver-connectivity\ndetection:\n    selection_shares:\n        EventID: 4000\n        ShareName|contains:\n            - 'IPC$'\n            - 'ADMIN$'\n            - 'C$'\n    selection_status:\n        - SigningUsed: 'false'\n        - EncyptionUsed: 'false' # Note: typo in the original event field name\n    filter_main_local_ips:\n        - ClientAddress|cidr:\n              # IPv4\n              # - '10.0.0.0/8'\n              - '127.0.0.0/8'\n              - '169.254.0.0/16'\n              # - '172.16.0.0/12'\n              # - '192.168.0.0/16'\n              # IPv6\n              - '::1/128'  # IPv6 loopback\n              - 'fe80::/10'  # IPv6 link-local addresses\n              - 'fc00::/7'  # IPv6 private addresses\n        # The filters below cover the XML raw log\n        - ClientAddress|contains:\n              # IPv6\n              - '00000000000000000000000000000001' # ::1 - IPv6 loopback\n              - 'FE80000000000000' # fe80:: - IPv6 link-local addresses\n              - 'FC00000000000000' # fc00:: - IPv6 private addresses\n              # IPv4\n              # The \"?\" are meant to represent the port\n              # - '0200????C0A8' # 192.168.\n              # - '0200????AC' # 172.\n              # - '0200????0A' # 10.\n              - '0200????7F' # 127\n              - '0200????A9FE' # 169.254.\n    condition: all of selection_* and not 1 of filter_main_*\nfalsepositives:\n    - Connections from local or private IP addresses to SMB shares without signing or encryption enabled for older systems or misconfigured environments. Apply additional tuning as needed.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1021.002","id":"T1021.002","name":"SMB/Windows Admin Shares","page":"techniques/enterprise/T1021.002/"}],"data_path":"data/detection-rules/8d91f6e4-9f3b-4c21-ae41-2c5b7d9f7a12.json","kind":"sigma"}