Suspicious Rejected SMB Guest Logon From IP
Detects suspicious rejected SMB guest logon attempts from an IP address, which can be an indicator of an attempted PrintNightmare (CVE-2021-1675) remote code execution exploit or other brute-force/password guessing attacks against SMB. The rule specifically looks for EventID 31017 (SMB client security event for rejected guest logon) where the UserName is empty and the ServerName starts with '\1', which is often seen in exploit attempts.
Sigma
