SMB Authentication Brute Force

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects SMB authentication brute force attempts by looking for multiple NTLMSSP_AUTH messages over port 445 (SMB) from the same source IP within a 30-second window. A threshold of 10 attempts triggers the alert, indicating a potential brute force attack against SMB authentication.