Skip to content
Threat Feed
Subscribe
high advisory

Detection of external remote SMB logon activity

Successful remote SMB authentication originating from external, non-private IP addresses can indicate exposed services and potential credential exploitation.

Triage facts

Revision 1
Applicability
Windows
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 6, 22:59 UTC
Detection
1 rule
Source quality
B2Likely

This brief addresses the detection of successful remote SMB (Logon Type 3) authentication sessions where the source IP address is classified as a public IP. Such activity suggests that the SMB service is exposed to the internet, creating a significant risk for brute-force attacks, credential stuffing, or unauthorized remote file access.

Recommendation

  • Deploy the Sigma rule below to monitor for successful external SMB logons in Windows Security event logs.
  • Audit edge firewalls to ensure TCP port 445 is not exposed to the public internet.
  • Implement restrictive network ACLs or VPN requirements for any service requiring SMB access.
  • Review authentication logs for accounts consistently triggering these alerts to identify potentially compromised credentials.

Immediate actions

Review perimeter firewall configurations to identify exposed SMB (TCP 445) ports.

IT Operations 24h

Threat Hunt

Identify historical 4624 events from non-RFC1918 IPs

T1133 high high confidence hunt now

Data: Windows Event Log 4624

Mitigations

Block TCP 445 on internet-facing interfaces.

immediate IT Operations

SMB port exposure

Detection coverage 1

Detect Successful External Remote SMB Logon

high

Detects successful remote SMB authentication (Logon Type 3) originating from non-RFC1918 (public) IP addresses, indicating potential exposure of the SMB service.

sigma tactics: initial_access techniques: T1078, T1133 sources: security, windows

Detection queries are available on the platform. Get full rules →