Perimeter-Security - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/perimeter-security/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 06 Nov 2026 22:59:37 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDetection of external remote SMB logon activityhttps://feed.craftedsignal.io/briefs/2026-11-external-smb-login/Fri, 06 Nov 2026 22:59:37 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-external-smb-login/Successful remote SMB authentication originating from external, non-private IP addresses can indicate exposed services and potential credential exploitation.This brief addresses the detection of successful remote SMB (Logon Type 3) authentication sessions where the source IP address is classified as a public IP. Such activity suggests that the SMB service is exposed to the internet, creating a significant risk for brute-force attacks, credential stuffing, or unauthorized remote file access.

Recommendation

  • Deploy the Sigma rule below to monitor for successful external SMB logons in Windows Security event logs.
  • Audit edge firewalls to ensure TCP port 445 is not exposed to the public internet.
  • Implement restrictive network ACLs or VPN requirements for any service requiring SMB access.
  • Review authentication logs for accounts consistently triggering these alerts to identify potentially compromised credentials.
]]>highadvisorywindowssmbauthenticationperimeter-security