All Detections

[VL] - New KSMBD DoS (CVE-2025-38501) can exhaust SMB connections via half-open TCP handshakes

avatar
Sergio Albea@Sergio_Albea
updated Sep 17, 20256054

New KSMBD DoS (CVE-2025-38501) can exhaust SMB connections via half-open TCP handshakes — patch to Linux 6.1.15+ or rate-limit TCP/445 to mitigate. This KQL query helps to hunt for connection attempts to port 445 across Linux endpoints in Defender XDR:

Microsoft Sentinel (KQL)