Analytics Informational
✕

A user established an SMB connection to multiple hosts

A user established an SMB connection to multiple hosts. This might indicate an enumeration attempt by a compromised account.

Module:
Identity Analytics
Data source:
XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Lateral Movement (TA0008)
ATT&CK techniques: Remote Services (T1021)
Attacker's goals:

Adversaries can effectively map out and strategize their lateral movement within a network by leveraging diverse protocols for reconnaissance.

Investigative actions:

Verify if the host is a newly deployed server that consists of SMB services to multiple hosts. Look for the process that initiated this activity on the remote host. Check if the user is authorized to perform such activity.

Test period:
10 Minutes
Deduplication:
1 Day
2 variations:
  • A user established an SMB connection to multiple hosts for the first time Medium (parent: Informational)
  • A user performed an abnormal SMB activity to multiple hosts Low (parent: Informational)