A user established an SMB connection to multiple hosts

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	10 Minutes
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules	Identity Analytics
Detector Tags
ATT&CK Tactic	Lateral Movement (TA0008)
ATT&CK Technique	Remote Services (T1021)
Severity	Informational

A user established an SMB connection to multiple hosts. This might indicate an enumeration attempt by a compromised account.

Adversaries can effectively map out and strategize their lateral movement within a network by leveraging diverse protocols for reconnaissance.

Verify if the host is a newly deployed server that consists of SMB services to multiple hosts.
Look for the process that initiated this activity on the remote host.
Check if the user is authorized to perform such activity.

A user established an SMB connection to multiple hosts. This might indicate an enumeration attempt by a compromised account.

Adversaries can effectively map out and strategize their lateral movement within a network by leveraging diverse protocols for reconnaissance.

Verify if the host is a newly deployed server that consists of SMB services to multiple hosts.
Look for the process that initiated this activity on the remote host.
Check if the user is authorized to perform such activity.

A user established an SMB connection to multiple hosts. This might indicate an enumeration attempt by a compromised account.

Adversaries can effectively map out and strategize their lateral movement within a network by leveraging diverse protocols for reconnaissance.

Verify if the host is a newly deployed server that consists of SMB services to multiple hosts.
Look for the process that initiated this activity on the remote host.
Check if the user is authorized to perform such activity.