Mahmoud Elfawair
@mahmoudelfawair0 followers5 downloads4 copies0 likes71 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
1
1
1
This detection identifies outbound NTLM authentication attempts to remote SMB servers with suspicious characteristics consistent with the use of impacket-smbserver, a tool commonly used by adversaries for lateral movement and data exfiltration. The detection looks for RemotePort 445 traffic where:
- The server version is the anomalous string 255.255 65535 255
- Server identity fields (DNS and NetBIOS names) are exactly 8 characters long, which is typical for randomly generated names by impacket-smbserver
This pattern strongly indicates impersonation or malicious SMB hosting by an attacker within the network.
- The server version is the anomalous string 255.255 65535 255
- Server identity fields (DNS and NetBIOS names) are exactly 8 characters long, which is typical for randomly generated names by impacket-smbserver
This pattern strongly indicates impersonation or malicious SMB hosting by an attacker within the network.
