[IA] - SMB/NTLM Negotiation to Unknown Remote IPs
NetworkSignatureInspected just means the network sensor saw and matched a signature (it inspected the packet) — it doesn’t mean the flow was blocked. That’s the problem. If your machines are negotiating SMB or NTLM with unknown remote IPs, you’ve got a real risk on your hands: data leakage, credential relay, or worm-style propagation. SMB to the Internet is almost never legitimate; if you don’t recognize the remote IP, treat it as suspicious. The KQL query includes multiple conditions to detect not only default connections on legacy (139) or modern (445) SMB ports, but also cases where SMB is running over non-standard ports (attempts to evade simple port-based detection). It also extracts the SMB negotiation state so you can spot repeated or incomplete negotiation attempts (useful to detect scanning, failed auths, or relay attempts).
Microsoft Sentinel (KQL)
