ATT&CK T1021.002 - Internal SMB Lateral Movement

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects internal Server Message Block (SMB) lateral movement attempts. It triggers when there are 10 or more SMB connections (identified by the "|FF|SMB" content signature) from a single source IP address to any destination on port 445 within a 60-second window, within the home network. This behavior is indicative of an attacker attempting to move laterally within a network using SMB.