Third Party Vendor SMB Access from External

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects Server Message Block (SMB) access attempts from external sources to internal networks, specifically looking for NTLMSSP (NT LAN Manager Security Support Provider) authentication traffic. It triggers an alert if five such connections are observed from the same source IP within a 60-second window. This could indicate an attempt by a third-party vendor or an attacker to access internal resources via SMB.