Domain Account Used for Lateral SMB Access
This rule detects network traffic indicative of a domain account being used for lateral movement via SMB. It specifically looks for NTLMSSP authentication within SMB traffic directed to port 445 on the home network, containing the string 'domain' (case-insensitive). A threshold of 10 occurrences within 60 seconds from the same source IP triggers the alert, suggesting a potential brute-force or rapid access attempt.
Suricata
