Analytics Informational
✕

Abnormal SMB scanning activity to multiple hosts

An endpoint performed a new, unfamiliar SMB scanning activity to multiple hosts on the network.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Reconnaissance (TA0043)
ATT&CK techniques: Active Scanning (T1595)
Attacker's goals:

An adversary may use different protocols to enumerate and plan its lateral movement over the network.

Investigative actions:

Verify if the host is a newly deployed server that consists of SMB services to multiple hosts or periodic network mapping services. Verify the legitimacy of the actor process (and its causality) that initiated this SMB traffic.

Test period:
20 Minutes
Deduplication:
2 Days
4 variations:
  • Highly rare SMB scanning activity to multiple hosts Low (parent: Informational)
  • Highly rare SMB scanning activity to multiple hosts Low (parent: Informational)
  • Abnormal SMB scanning activity to multiple hosts Low (parent: Informational)
  • Abnormal SMB scanning activity to multiple hosts Low (parent: Informational)