Unsigned or Unencrypted SMB Connection to Admin Share

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•21

Detects Server Message Block (SMB) server connections to administrative shares (IPC$, ADMIN$, C$) that are established without signing or encryption enabled. This activity could indicate potential lateral movement by an adversary exploiting insecure SMB configurations.