Potential GhostLock SMB File Locking Activity
Detects potentially malicious SMB activity associated with GhostLock-style availability attacks. This analytic identifies suspicious SMB access patterns where scripting engines or uncommon SMB client processes initiate large numbers of SMB connections and file open operations without corresponding write activity. GhostLock abuses Windows file locking semantics by opening files on SMB shares using exclusive deny-share handles, preventing legitimate access without encrypting, renaming, or modifying the underlying files. This rule is intended as a detection building block and should be correlated in the SIEM to identify: - High SMB FILE_OPEN volume - Zero SMB FILE_WRITE activity - Long-lived SMB sessions or handles - Repeated activity from a single source host or account Recommended correlation logic: - Group by source IP, username, and destination server - SMB FILE_OPEN count > 1000 - SMB FILE_WRITE count == 0 - Time window: 15-30 minutes
Sigma
