Unusual Outbound SMB Traffic
This rule detects unusual outbound Server Message Block (SMB) traffic originating from common Windows processes (explorer.exe, svchost.exe, system.exe) to external IP addresses (not RFC1918 private ranges). It triggers if a device makes 5 or more SMB connections to unique remote IPs within an hour. This could indicate lateral movement, data exfiltration, or other malicious activity.
Microsoft Sentinel (KQL)
