Suspicious Rejected SMB Guest Logon From IP (via smbclient-security)

title: Suspicious Rejected SMB Guest Logon From IP (via smbclient-security)
id: cf1cdb1d-91ca-5d8a-87e5-0fa55a8e9819
status: stable
description: This rule detects Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service
references:
    - https://attack.mitre.org/techniques/T1110/001/
    - https://twitter.com/KevTheHermit/status/1410203844064301056
    - https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
    - https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare
author: Huntrule Team
date: 2026-03-09
tags:
    - attack.credential-access
    - attack.t1110.001
logsource:
    product: windows
    service: smbclient-security
detection:
    selection:
        EventID: 31017
        UserName: ''
        ServerName|startswith: '\1'
    condition: selection
falsepositives:
    - Unknown
level: medium