Mass Account Lockout via Remote SMB Command

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects attempts to remotely lock out user accounts via SMB (Server Message Block) by looking for specific content within TCP traffic on port 445. It specifically targets the 'NetUserSetInfo' function call, which can be used to modify user account properties, in conjunction with the keyword 'lockout'. This combination suggests an attacker is attempting to trigger a mass account lockout.