Analytics Low
✕

Abnormal SMB activity to multiple hosts

An endpoint performed a new, unfamiliar SMB activity to multiple hosts on the network.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Lateral Movement (TA0008)
ATT&CK techniques: Remote Services (T1021)
Detector tags: NDR Lateral Movement Analytics
Attacker's goals:

An adversary may use different protocols to enumerate and plan its lateral movement over the network.

Investigative actions:

Verify if the host is a newly deployed server that consists of SMB services to multiple hosts. Verify the legitimacy of the actor process (and its causality) that initiated this SMB traffic.

Test period:
5 Hours
Deduplication:
1 Day
4 variations:
  • Highly rare SMB activity to multiple hosts Low
  • Highly rare SMB activity to multiple hosts Medium (parent: Low)
  • Abnormal SMB activity to multiple hosts Medium (parent: Low)
  • Abnormal SMB activity to multiple hosts Low