ATT&CK T1039 - Bulk SMB File Read from Network Share

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects bulk Server Message Block (SMB) file read activity from a network share. It specifically looks for TCP traffic on port 445 (SMB) from any source within the home network to any destination within the home network, indicating established connections. The rule triggers if it observes 100 or more SMB packets (identified by the content "|FF|SMB") within a 60-second window from a single source IP address. This behavior could be indicative of data collection or exfiltration from network shares.