Impacket SMB Server Detection via NTLM Authentication
This detection identifies outbound NTLM authentication attempts to remote SMB servers with suspicious characteristics consistent with the use of impacket-smbserver, a tool commonly used by adversaries for lateral movement and data exfiltration. The detection looks for RemotePort 445 traffic where: - The server version is the anomalous string 255.255 65535 255 - Server identity fields (DNS and NetBIOS names) are exactly 8 characters long, which is typical for randomly generated names by impacket-smbserver This pattern strongly indicates impersonation or malicious SMB hosting by an attacker within the network.
Microsoft Sentinel (KQL)
