Unsigned or Unencrypted SMB Connection to Share Established

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•0•0

Detects SMB server connections to shares without signing or encryption enabled. This could indicate potential lateral movement activity using unsecured SMB shares.