win:smb
SMB client/server logs
Channels: Microsoft-Windows-SMBClient/Security, SMBServer
- Host type
- Windows (workstation, member server, domain controller)
- Techniques
- 1
- Rules listed
- 2
- Events
- 5
Techniques
Rules
Sigma 2
- Potential CVE-2023-23397 Exploitation Attempt - SMB by Nasreddine Bencherchali (Nextron Systems)
- Suspicious Rejected SMB Guest Logon From IP by Florian Roth (Nextron Systems), KevTheHermit, fuzzyf10w