{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/perimeter-security/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["windows","smb","authentication","perimeter-security"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThis brief addresses the detection of successful remote SMB (Logon Type 3) authentication sessions where the source IP address is classified as a public IP. Such activity suggests that the SMB service is exposed to the internet, creating a significant risk for brute-force attacks, credential stuffing, or unauthorized remote file access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule below to monitor for successful external SMB logons in Windows Security event logs.\u003c/li\u003e\n\u003cli\u003eAudit edge firewalls to ensure TCP port 445 is not exposed to the public internet.\u003c/li\u003e\n\u003cli\u003eImplement restrictive network ACLs or VPN requirements for any service requiring SMB access.\u003c/li\u003e\n\u003cli\u003eReview authentication logs for accounts consistently triggering these alerts to identify potentially compromised credentials.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T22:59:37Z","date_published":"2026-11-06T22:59:37Z","id":"https://feed.craftedsignal.io/briefs/2026-11-external-smb-login/","summary":"Successful remote SMB authentication originating from external, non-private IP addresses can indicate exposed services and potential credential exploitation.","title":"Detection of external remote SMB logon activity","url":"https://feed.craftedsignal.io/briefs/2026-11-external-smb-login/"}],"language":"en","title":"CraftedSignal Threat Feed - Perimeter-Security","version":"https://jsonfeed.org/version/1.1"}